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1. AN OVERVIEW OF NASA'S DIGITAL FLY-BY-WIRE 


TECHNOLOGY DEVELOPMENT PROGRAM 

Calvin R. Jarvis 
NASA Flight Research Center 


SUMMARY 


The feasibility of using digital fly-by-wire systems to control aircraft was 
demonstrated by developing and flight testing a single channel system , which used 
Apollo hardware, in an F-8C test airplane. This is the first airplane to fly with a 
digital fly -by-wire system as its primary means of control and with no mechanical 
reversion capability . The development and flight test of a triplex digital fly -by- 
wire system , which will serve as an experimental prototype for future operational 
digital fly-by-wire systems , is underway. 


INTRODUCTION 


The advantages of digital fly-by-wire (DFBW) systems in terms of control 
system flexibility and reliability were demonstrated for spacecraft applications in 
NASA's manned space program, However , the transfer of this technology from 
spacecraft to aircraft is not direct and will require the identification and solution 
of many problems . 

DFBW technology , when fully utilized in the flight control system of an air- 
craft, can provide significant advantages over conventional control systems in 
terms of reduced costs, weight, and volume, and in improved performance. A 
redundant digital system, which can identify in-flight system failures and recon- 
figure itself, offers a potential reliability comparable to that of the basic aircraft 
structure as well as the advantages of automatic control techniques . 

Although these benefits cannot be easily quantified for all classes of aircraft , 
design studies do indicate major rewards in terms of more effective flight control 
systems and, thus, more effective aircraft. But even more important, these sys- 
tems lay the ground work for active control technology , and it is the active- 
control-configured aircraft that -offers the greatest potential in economic gains and 
performance advancements. 



The overall objective of NASA's digital fly-by- wire program is to provide the 
foundation for this technology , in terms of design criteria and operational experi- 
ence , which will lead to the development of practical digital fly-by-wire systems 
for future aircraft . To accomplish this obj ective , the program was separated into 
two phases , with an F-8C airplane (fig. 1) used as the test vehicle. 

The goal of Phase I , which has been accomplished , was to demonstrate the 
feasibility of using a DFBW system as the primary flight control system of an air- 
craft . To accomplish this goal , a single channel DFBW primary flight control sys- 
tem was flight tested, using an analog backup control system for fail/safe redun- 
dancy . 

The goal of Phase II is to establish a design base for the development of prac- 
tical DFBW systems . This will involve the development and flight test of a triplex 
DFBW system using redundancy management and data bus concepts . 

Figure 2 shows the schedule for Phases I and II. The major aspects of each 
phase are discussed in the following sections . 


SINGLE CHANNEL SYSTEM DEVELOPMENT 


To establish the feasibility of the DFBW concept , a system was designed to 
replace the basic mechanical primary flight control system of the F-8C test airplane 
in all three control axes. All mechanical connections linking the pilot's control 
stick and rudder pedals to the control surfaces were removed. To be compatible 
with fly-by-wire design philosophy and development practice, no mechanical 
reversion capability was provided even during the first part of the flight-test pro- 
gram . This is particularly significant because it required that satisfactory design 
and test techniques be demonstrated before the first flight . A single channel 
digital system concept was selected as the most straightforward approach to estab- 
lishing system feasibility. 

To minimize cost and development time , digital hardware and software orig- 
inally developed for the Apollo program were used as the heart of the digital sys- 
tem . An Apollo guidance and navigation system was used which consisted of a 
digital guidance computer, an inertial measurement unit, and associated interface 
elements. Use of this hardware also made available highly trained Apollo support 
teams . Another factor leading to the selection of the Apollo computer was its 
demonstrated 70,000-hour mean-time-before-failure record. This factor overrode 
shortcomings of the hardware which resulted in some operational constraints. 

A more complete description and discussion of the digital system is presented 
in paper 2. Pertinent aspects of man-rated software are covered in paper 4. 

To provide redundancy if the primary digital system failed, an analog flight 
control system from a lifting body research vehicle was modified extensively and 
installed in the F-8C airplane' as a triplex analog backup control system (paper 3) . 
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Phase I began in January 1971 . During the following 15 months , five major 
contractors took part in the development and flight qualification of the Phase I sys- 
tem . These contractors and their areas of responsibility were: 


Delco Electronics 

The Charles Stark Draper 
Laboratory , Inc . (MIT) 

Sperry Flight Systems Division . 

Hydraulic Research and 
Manufacturing Company 

Ling-Temco-Vought , Inc . 


. Digital system hardware 
, Digital system software 

. Analog backup control system 
. Secondary actuators 

. Aircraft and electrical systems 


In addition to control law design and contractor coordination , NASA was 
responsible for specifying the Phase I system baseline configuration and interface 
requirements, verifying the final software and hardware flight readiness, and con- 
ducting the flight tests . 

The Phase I system was first used in flight on May 25, 1972. This was the first 
flight of an aircraft in which a digital fly-by-wire flight control system was the 
primary means of control . As noted previously , no mechanical reversion capability 
was provided . Confidence in the reliability of the digital system was demonstrated 
by using it on the first takeoff and landing. 

Forty-two flights were made before the flight program was completed in 
November 1973. The total flight time was 58 hours. The pilot controlled the air- 
plane most of this time using the primary digital system. Approximately 14 hours 
were flown using the analog backup system for evaluation purposes , inasmuch as no 
digital system failures were experienced during flight . The flight -test results are 
presented in papers 3 and 6. 

Phase I established the feasibility of DFBW systems for primary aircraft control 
and provided flight data related to control law design, software verification, and 
operational procedures for DFBW systems . 


MULTICHANNEL SYSTEM DEVELOPMENT 


The goal of Phase II is to establish a design base for the development and imple- 
mentation of future practical DFBW systems. To accomplish this goal a multi- 
channel system is being developed which will provide redundancy management 
flight-test experience and verify other concepts of particular concern to the space 
shuttle orbiter development. 

The Phase II system configuration and major tasks are discussed in the follow- 
ing sections . 



System Configuration 


A simplified diagram of the fully redundant triplex DFBW system is shown in 
figure 3 . The principal elements of the system are to be installed on a removable 
pallet assembly , as the single channel system was in Phase I . Major components 
developed for Phase I, such as the analog backup control system, redundant 
secondary actuators , electrical power system , and instrumentation system , are to 
be retained for use during Phase II, 

Dedicated, redundant sensors will be used to measure airplane angular rate, 
attitude, acceleration, and air data, Sensor inputs will be cross-strapped to each 
computer and synchronized on a bit-by-bit basis . Surface command outputs will 
be voted for fault detection and supplied to the triplex, force-summed, secondary 
actuator servo valves , Differential pressure equalization will be used to minimize 
nonlinear secondary actuator effects. A two channel (active and monitor) analog 
backup control system will be provided for use if the primary system fails . 

The system will be designed to minimize ground operational and preflight 
support requirements. All system status testing will be automated and will be done 
onboard the airplane. 


The digital processor selected for Phase'll is a state-of-the-art, off-the-shelf, 
general-purpose computer with floating-point and microprograming features. The 
computer is an order of magnitude faster than the Apollo computer used in Phase I . 
The main storage memory is fully programable , which provides greater software 
flexibility . This increase in computer capability is of particular importance in 
carrying out the objectives of the Phase II program, 


Evaluation of Space Shuttle Orbiter DFBW Concepts 

An important aspect of Phase II is coordination with the shuttle orbiter flight 
control system development . In addition to being the first application of DFBW in 
an aerodynamic vehicle , the orbiter will contribute significantly to digital system 
technology by addressing the problems of redundancy management (reliability) 
and overall mechanization . 

The shuttle flight control system will use the same digital processors as those 
being used in Phase II of the F-8 DFBW program. The Phase II triplex processor/ 
sensor configuration will thus make it possible to evaluate certain aspects of the 
shuttle system by using the F-8C airplane as a test-bed. 

Redundancy management . — The redundancy management concept developed 
for the orbiter system to detect and isolate digital processor and control system 
sensor failures will be implemented and flight tested during Phase II. Because a 
reliable means of achieving failure detection and isolation is a major problem in the 
design of redundant DFBW systems , flight-test verification of the concepts in 
Phase II will establish a significant data base for future applications , 

Data bus . — The data bus concept of reducing cabling and connector require- 
ments for redundant systems by compressing data from several sensors onto 
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redundant transmission lines is important in the development of DFBW technology . 
The discrete format of signals in DFBW systems makes the data bus a natural solu- 
tion to the complex cabling problem . In Phase II the technique proposed for the 
shuttle system will be used to process trim commands and mode panel information 
(e.g. , status lights , mode change commands) and to transmit the information from 
the airplane cockpit to the palletized system in the equipment bay . This will 
greatly reduce the number of wires and will verify data bus utility for shuttle as 
well as future system applications . 

Computer synchronization. — Of major concern in the design of any redundant 
DFBW system is whether or not to synchronize the computer operations and , if so , 
the best way to do it . The Phase II system will be designed with enough flexibility 
to permit the use of various synchronization approaches as well as asynchronous 
operation . Included will be the baseline approach selected for the orbiter system . 

Control laws. — The first control laws to be evaluated in flight during Phase II 
will be similar to those developed for the F-8C airplane during Phase I and similar 
in format to those being developed for the shuttle orbiter . These include C* and 
rate command modes for pitch and roll as well as direct control modes for each axis . 
Control law software required for moding and initialization will therefore be similar 
for both programs , which will permit some system verification. 

Higher order programing language . — A higher order programing language, 
called Higher Aerospace Language (HAL) , is being developed in support of shuttle 
software requirements . Use of this language in developing certain elements of the 
control laws for the Phase II system will make it possible to debug and verify it 
before it is actually applied to the shuttle orbiter . 

Backup control system. — The present shuttle system configuration will require 
a dissimilar single channel digital backup control system during initial horizontal 
flight tests to override possible primary system generic failures . The executive 
structure for the shuttle backup system will be implemented in the Phase II system 
and flight-qualified through flight -test verification. 


Advanced Control Law Development 

To assess the capability of a digital system to perform the functions necessary 
for future active control applications, additional control laws will be programed and 
evaluated during Phase II . A specific task is the investigation of improvements that 
can be made in aircraft control law implementation as a result of the rapidly advanc- 
ing digital fly-by-wire system capability . The availability of a powerful onboard 
digital computer system that can process sophisticated flight control laws in real 
time has added a new dimension to realizable control law development . Control 
laws previously too complex and unwieldy for analog system applications can now 
be considered prime candidates for digital applications . 

Initial Phase II control law research is directed toward the use of active control 
for maneuver load control, possible improvement in ride quality, suppression of 
turbulence effects, flight envelope limiting techniques, and operation at reduced 
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static -stability margins. The basic elements of such a control law now being devel- 
oped for the longitudinal axis are illustrated in figure 4. The structure consists of 
a boundary controller for angle-of-attack limiting , a normal controller for longi- 
tudinal commands, a direct-lift controller for commanding symmetric ailerons, a 
load controller , and autopilot modes . A proportional flap-to-elevator crossfeed is 
planned to compensate for the pitching moment produced by symmetric aileron 
deflection . 

The design objective for the longitudinal axis is to achieve good handling 
qualities by matching desired response criteria for both positive and negative static 
stability margins . Gust load alleviation is provided by additional damping of short- 
period dynamics using the elevator surface. Angle-of-attack limiting is provided 
throughout the flight envelope . 

Direct lift of the symmetric ailerons is combined with the elevator to minimize 
drag during maneuvers and to enhance gust load alleviation during cruise . The 
three autopilot modes are the conventional attitude hold , altitude hold , and Mach 
hold . 

Other advanced control law prospects , in which adaptive techniques and optimal 
control theory are used, are being studied for possible flight -test evaluation during 
Phase II . 


Remotely Augmented Vehicle Facility 

As part of Phase II , a unique remotely augmented vehicle facility is to be 
developed to support advanced control law research and flight-test evaluation . 

A diagram of the proposed facility is shown in figure 5 . During a test flight , a 
special remotely augmented vehicle test mode may be selected by the pilot that will 
divert his control commands to a ground computer facility , via a telemetry down- 
link , on which a particular advanced control law to be evaluated is programed . 
Control surface commands are determined by the ground computer on the basis of 
the pilot's airborne commands, the airplane's response, and the programed control 
law. The surface commands are then transmitted, via a telemetry up-link, to the air 
plane system and the corresponding control surface . The pilot flies the airplane 
through the control laws programed on the remotely located ground computer . Fail 
safety will be maintained through the use of reasonability tests built into the ground 
computer facility and safety networks in the telemetry equipment . This approach 
will permit a great deal of flexibility for control law evaluation without compro- 
mising the basic airborne system verification requirements . 


CONCLUDING REMARKS 


The full realization of the benefits of active control technology and the benefits 
predicted by its application to aircraft design depends on the development of prac- 
tical, reliable, and versatile 'digital fly-by-wire (DFBW) control systems. The 
feasibility of such systems and confidence in their reliability and integrity were 
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established in Phase I of the F-8 DFBW program. The goal of Phase II of the pro- 
gram is to establish a design base from which practical, reliable systems can be 
developed. This will be accomplished by developing and flight testing a fully 
redundant triplex DFBW system . 

The multichannel system development carried out during Phase II will establish 
techniques for validating redundant system software and hardware interfaces and 
for establishing operating procedures unique to DFBW systems. Flight-test eval- 
uation of orbiter control system concepts using the F-8C airplane will result in 
verification of redundancy management software for digital processor and sensor 
fault detection and reduced generic failure probabilities for the orbiter system. 

Flight -test evaluation of advanced control laws during Phase II will provide an 
opportunity to assess the capability of DFBW systems to perform the complex control 
tasks associated with active control applications . 

The NASA DFBW program, although complementary to other fly-by-wire 
activities , is aimed specifically at providing the technology for practical digital 
flight controls for civil aircraft. As such, it represents the first step toward a new 
generation of active-control-configured aircraft which will offer significant economic 
advantages . 
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Figure 3. Phase II system configuration. 




Figure 4. 


Active control law diagram for longitudinal axis . 
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2 . DESIGN AND DEVELOPMENT EXPERIENCE 
WITH A DIGITAL FLY -BY -WIRE CONTROL SYSTEM 
IN AN F-8C AIRPLANE 


Dwain A . Beets 
NASA Flight Research Center 


SUMMARY 


To assess the feasibility of a digital fly-by-wire system , the mechanical flight 
control system of an F-8C airplane was replaced with a digital primary system and 
an analog backup system . The Apollo computer was used as the heart of the primary 
system . This paper discusses the experience gained during the design and develop- 
ment of the system and relates it to active control systems that are anticipated for 
future civil transport applications . 


INTRODUCTION 


A major deterrent to the application of active controls to transport aircraft has 
been a lack of experience in designing highly reliable flight control augmentation 
systems and verifying them in flight . Digital fly -by -wire technology has the 
potential for providing the necessary reliability while still offering design flexibility . 
To assess the feasibility of a digital fly -by -wire system , the NASA Flight Research 
Center conducted a flight research program in which the mechanical flight control 
system of an F-8C airplane was replaced with a digital primary system and an 
electrical analog backup system . 

This paper describes the fly -by -wire system and the design and development of 
the digital primary system . The system and the design procedures are assessed in 
light of similar applications being contemplated for future transport aircraft . 

The paper was written in conjunction with papers 3, 5,6, and 7 which discuss 
the backup control system, software management, and results from the flight tests. 
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SYMBOLS 


K proportionality constant 

KAZ normal acceleration feedback gain to stabilizer, deg/g 

KG stick or rudder pedal gearing constant , deg/m 

KP roll rate feedback gain to ailerons, deg/deg/ sec 

KQ pitch rate feedback gain to stabilizer, deg/deg/sec 

KR yaw rate feedback gain to rudder , deg/ deg/ sec 

q k pitch rate at k** 1 sample , deg/ sec 

s Laplace transform variable 

T sample period , sec 

sT 

z complex variable , e 

til. 

0^ pitch angle at k m sample 


TEST AIRPLANE 


An F-8C airplane (fig. 1) was selected for use in flight testing a digital fly-by- 
wire system. Several characteristics of the airplane made it suitable for this test 
program . The handling qualities without control augmentation were acceptable for 
emergency operation , thus backup control could be provided through a relatively 
simple system. In addition, the airplane had enough space for the system's compo- 
nents , and the capacity of the hydraulic systems was adequate . 

Some features of the F-8C airframe had an impact on the fly-by-wire system 
design. The variable-incidence wing moves up 8° for low-speed flight. This 
rotates the fuselage nose down relative to the free airstream, improving the pilot's 
visibility during the approach. Several functions within the flight control system 
are programed as a function of wing position . For example , the horizontal stabilizer 
is driven 5° leading edge up when the wing is raised. 

The F-8C airplane does not have independent flap surfaces, so the ailerons are 
driven collectively to serve as flaps through a mechanical linkage independent of 
the primary control system . For this program the linkage was disconnected and the 
ailerons were driven to the drooped flap position through the fly-by-wire system . 
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The original F-8C flight control system had a direct linkage in pitch (no augmen- 
tation) , and roll and yaw stability augmentation systems (SAS) (figs. 2(a) and 2(b)) . 
The yaw SAS included an aileron-to-rudder interconnect with a gain programed as 
a function of stabilizer position . 


DATA ACQUISITION SYSTEM 


A standard NASA pulse code modulation (PCM) system was installed to record 
airplane motion, pilot input, and fly -by -wire system parameters external to the 
computer . Seventy- seven channels of 9-bit data were recorded on an onboard tape 
and telemetered to a ground station for real-time monitoring . Eight of the channels 
were digital words indicating the state of 57 discrete values from the fly-by-wire 
system . Although excellent for automated data reduction , the PCM system proved 
to be unsuitable for investigating the effects of analog-to-digital and digital-to-analog 
quantization. The resolution of the PCM system was on the same order as that of the 
digital control system quantization , which made it difficult to isolate the effects of the 
control system quantization. 

Internal digital computer parameters were recorded on the onboard PCM tape 
recorder . One-hundred-word pairs were strobed out every 2 seconds and recorded 
for postflight analysis. The word lists were resident in the software onboard the 
airplane and could be reprogramed during the flight tests. This recording system 
was used primarily to determine the gross status of the computed parameters within 
the flight control system; the strobe rate was inadequate for tracing individual 
parameters each control computational cycle . 


IRON BIRD SIMULATOR 


An iron bird simulator played an important role in the development of the fly- 
by-wire system . The simulator consisted of another F-8C airplane , in which all the 
digital fly-by-wire flight control hardware was installed , tied in with a hybrid 
computer and appropriate interface equipment (fig . 3) . The digital fly-by-wire 
hardware was flight qualified and served as spares for the flight vehicle. The F-8C 
aerodynamics and bending modes were modeled by using the digital portion of the 
hybrid computer for the aerodynamics and the analog portion for the bending modes. 


FLY -BY -WIRE SYSTEM 


The fly-by-wire system had a digital primary control system and an electrical 
analog backup control system , Components of the fly-by-wire system are shown in 
figure 4 , and the location of the components in the F-8C airplane is illustrated in 
figure 5, 

A simplex digital primary system and a triplex electrical analog backup system 
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provided enough reliability that the mechanical system could be completely removed . 
The digital primary system consisted of a computer , inertial measurement unit, 
coupling data unit, and display and keyboard , all taken from the Apollo guidance 
and navigation system . Reference 1 provides details on this equipment relative to 
the Apollo application . The triplex backup control system consisted of only surface 
position command electronics . Specially designed electrohydraulic secondary 
actuators interfaced the primary and backup electronic commands with the conven- 
tional F-8C control surface power actuators. 

Components of the fly-by-wire system were part of the primary or backup 
system and, in some instances, were shared between the two systems. Individual 
components are described in the following sections according to function . 


Computational 

The Apollo computer performed all flight control computations in the primary 
control system . Characteristics of this computer are summarized in the following 
tabulation: 


Read-only memory 36,864 words 

Scratch pad memory .... 2,048 words 

Word length 14 bits plus sign and parity 

Number system ....... Fixed point , ones complement 

Memory cycle time 11 .7 microseconds 

Computation time — 

Add ........... 23 .4 microseconds 

Multiply ......... 46.8 microseconds 

Divide .......... 81 .9 microseconds 

Although slow by today's standards , the computer could perform all flight control 
functions within 30 milliseconds . Flight control laws for the F-8C airplane were 
programed for the computer's hardwired memory and could not be changed after the 
memory was manufactured . However , flexibility was achieved by placing feedback 
gains , logic flags, digital filter coefficients , and other gain variables in the 
computer's scratch pad memory; 105 of these variables associated with the flight 
control system could be changed. 

Control laws for the backup system were mechanized in triplex control electronic 
boxes , which can be considered to be special-purpose analog computers . Each 
electronic box contained 67 operational amplifiers . Requirements for high reliability 
in the flight environment dictated the use of ruggedized packaging and hardwired 
circuits. Consequently, flexibility for changing control laws was limited to gain 
and nonlinear constant changes; even these changes required replacement of hard- 
wired resistors and diodes. Although the control system is considered to be an 
analog system , more than half of each electronic box containing individual channels 
of the analog electronics was devoted to logic elements , such as comparators between 
the redundant channels. 
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Pilot Interface 


Vehicle control and trim inputs.— The center stick was the primary means of 
control for both the primary and the backup systems , It was connected to the basic 
F-8C mechanical feel system. Disconnecting the mechanical links to the control 
surface caused undesirable looseness in the lateral stick, so a viscous damper was 
added . Stick position was sensed through two separate linear variable differential 
transformers (LVDT) in each axis. Each LVDT had triplex windings. Two of the 
windings from one LVDT in each axis were used by the primary system; the third 
winding was for instrumentation . The second LVDT provided triplex inputs to the 
backup control system . 

A minimum displacement , two-axis side stick was used as an alternate controller 
input to the backup system . This side stick was not part of the original fly-by-wire 
system; it was used only as a means of evaluating a "force type" side stick controller 
in an actual aircraft environment (papers 3 and 7) . 

The rudder pedals provided inputs to both the primary and the backup systems. 
Similar to the center stick, they were connected to the F-8C mechanical feel system 
and used LVDT's for sensing rudder pedal position. 

Trim commands for primary pitch and roll were made through a two- axis beeper 
switch on the center stick. Backup trim inputs in all three axes were made through 
separate spring-loaded toggle switches on the pilot's left-hand console. These 
toggle switches were also used to provide primary yaw trim and primary pitch and 
roll trim inputs if the center stick trim switch failed . When the side stick was being 
used , trimming was accomplished through a beeper switch on the side stick . 


Fly-by-wire functional control. — Figure 6 shows the mode and power panel, 
which was the pilot's means of communicating with the primary system. The pilot 
was able to choose between several different control system modes simply by 
depressing the appropriate button. Additionally , he was able to change system gains 
according to the logic loaded in the software before the flight , Several primary 
system failure status lights were located across the top of the panel , and power 
switches and power status lights were located across the bottom . Individual axes 
could be transferred to backup through the backup control system (BCS) switches. 
The pilot could also transfer all axes to backup simultaneously by using a "paddle 
switch" on the center stick. 

A servo engage panel on the left-hand console permitted the pilot to selectively 
engage or disengage each channel of each servo actuator . The panel provided 
control over both the backup and the primary systems . The status of the actuation 
system and the backup electronics was displayed on this panel. 


Motion Sensing and Interface 

Another component from the Apollo guidance and navigation system was the 
inertial measurement unit. Although angular body rates and linear accelerations 
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were not measured directly in the Apollo application, the substitution of aircraft 
gyros and accelerometers for the fly-by-wire tests would have required a major 
system modification and would have sacrificed the integrity of the total Apollo 
system. An alternate approach was adopted: Body rates and linear accelerations 
were computed from the gimbal angles and the digital incremental velocity vector 
information the inertial measurement unit provided to the Apollo computer for use in 
the primary system . 

A coupling data unit provided the interface between the inertial measurement 
unit and the Apollo computer in the Apollo guidance system and provided the same 
function for the primary system in the F-8C application . The angular resolution was 
0.011°; however, the rate resolution was of more importance and was nonlinear with 
gimbal angle rate . Body angular rate estimation was directly related to gimbal angle 
rate resolution. Gimbal rate resolution was ±0.183 deg/sec for rates less than 
4.4 deg/ sec, and ±2.74 deg/sec for rates between 4.4 deg/ sec and 70 deg/sec. The 
error was manifested as a random noise band of 2.74 deg/sec peak to peak for rates 
greater than 4.4 deg/sec. Acceleration was sensed by using pulse integrating 
pendulous accelerometers . The quantization level for the normal acceleration sig- 
nals was 0.2g. 

The coupling data unit contained several digital-to - analog converter channels , 
which made it possible to send the necessary primary system commands to the 
control surfaces. To protect against undetected failures between the computer and 
the surface actuators , dual signals were generated in each axis , beginning with 
dualized commands to dual digital-to-analog converters in the coupling data unit in 
each axis . The control surface drive signals were quantized to ±384 levels , which 
is somewhat less than a full 9-bit word . 


Control Surface Actuation 

Similar actuation systems were used in each axis. Each actuation system had a 
secondary actuator and a power actuator . Separate sets of actuators were used for 
the left and right horizontal stabilizers and ailerons. A single set of actuators was 
used for the rudder. 

The hydraulic power actuators from the basic F-8.C airplane were used without 
modification . Electrohydraulic secondary actuators were installed to drive the 
metering valves of each of the five power actuators. The secondary actuators 
acted as three-chamber force summing devices when driven from the backup system . 
The primary system drove the secondary actuators through active monitor servo 
valves . 

When the secondary actuators were driven through the primary system , they 
were stabilized through the active servo valve in the primary system electronics 
box. Analog 5-hertz low -pass filters were included in the primary system elec- 
tronics. When driven through the backup servo valves, the secondary actuators 
were stabilized in the backup system electronics packages , one for each of the three 
backup channels . 
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Paper 3 describes the actuation systems in more detail . 


Primary /Backup System Interface 

A functional diagram of the fly-by-wire system is shown in figure 7 . The 
Apollo computer received inputs from the pilot's stick together with aircraft motion 
information from the inertial measurement unit. Surface commands were computed 
according to the programed control laws . 

The two drive signals for each surface represented commands to the secondary 
actuator position loop, which was closed with analog stabilization electronics outside 
the Apollo computer . As shown in figure 7 , there was an active and a monitor servo 
path. If a failure occurred in either path, a hydraulic comparator would sense the 
differential pressure between the active and the monitor servo valve and transfer 
control to the backup control system . As long as the primary control system was 
operating normally , the backup control system would track the active channel by 
way of the synchronization network. Only the hydraulic pressure was bypassed at 
the secondary actuator , so that the backup system was ready to take over at any 
time. If a transfer to the backup system was requested, the bypass was removed 
and the synchronization network was disabled , resulting in immediate proportional 
control from the pilot's stick. In the backup mode, the active servo valve was 
blocked and the secondary actuator operated as a force summer for the three backup 
channels. The digital computer continued to operate, computing the control laws 
which gave the best estimate of what the backup system commanded. If a transfer 
to the primary control system was attempted , the transient was small as long as the 
computer was tracking the backup system . If the error was excessive between the 
primary control system and the backup control system , a cross-channel comparator 
prevented transfer to the primary control system . 


Fault Detection 

Although built-in fault detection was extremely important for both the primary 
and the backup systems , it was of particular importance in the primary system . 
Because the primary system was full authority as well as single channel, its 
responses could have been hazardous if failures were not handled properly . 
Therefore, it had to be established that no digital computer system hardware failure 
could cause a hardover or otherwise hazardous signal. Figure 8 shows the type of 
digital system failure detection used. The Apollo computer had an extensive and 
proved fault detection and reporting system which was built into the computer 
hardware (item 1 in the figure) . This system, modified slightly for application to 
the F-8C airplane, was the most significant portion of the failure detection system. 
Some of the types of failures detected were: 

Logic circuits — 

Parity failed 

Program entered loop and did not exit 

Program attempted to access unused read-only memory 

Program failed to check in occasionally 
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Analog circuits — 

Voltage went out of limits 

Oscillator failed 

Timing pulse generator failed 

Each of the failures caused a restart, that is, a hardware-forced transfer out of the 
control law program to a software routine which performed several clearing and 
initialization steps in an attempt to correct the cause of the restart before allowing 
control law computations to continue . For some restart conditions , a signal was 
issued which caused a transfer to the backup control system . 

The Apollo computer also monitored the performance of the inertial measurement 
unit (item 2 , fig. 8) . Written into the software were decisions either to transfer the 
system to the backup control system for serious failures or to select the direct mode 
in the primary system for situations such as an inertial measurement unit acceler- 
ometer failure, which would affect only certain augmented modes. 

Analysis of primary system failures showed the need for additional hardware 
failure detection circuitry (item 3 , fig 8) . The failure of certain channel outbits 
not monitored by the Apollo computer , in combination with normal pilot reactions , 
could have led to hazardous situations. These conditions first became apparent in 
piloted, closed-loop simulations using the iron bird simulator. The necessary hard- 
ware modifications were made and implemented in the system to circumvent these 
failure conditions or to cause a transfer to the backup control system when prevention 
was not possible . 

Built-in test equipment for the backup system and primary electronics was 
provided in the pilot's side console . This self -test equipment could be activated 
only during preflight tests (paper 3) . 


FLIGHT CONTROL SOFTWARE 


Software flexibility made it possible to investigate a multimode F-8 digital flight 
control system using hardware that was designed for an entirely different purpose — 
guidance and navigation in space. The structure of the primary system control laws, 
which were implemented through software , and the associated logic functions are 
described . 


Control Law Modes 

Control in each axis was provided in the control laws . The simplest form in 
each axis was the direct mode, illustrated in figure 9. The control law structure 
and gain settings were selected to be as close as possible to those of the backup 
control system . The first level of augmentation was rate feedback in the pitch and 
roll axes. Figure 10 illustrates these SAS modes as they were during flight tests. 
In the yaw axis , an aileron-to-rudder interconnect was included in addition to the 
yaw rate feedback (fig, 11) . The most advanced type of control law was a blended 
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pitch rate and normal acceleration command augmentation mode , illustrated in 
figure 12 , 

The sampled-data aspect of the digital fly-by-wire system significantly affected 
the implementation of the software. The pitch SAS mode, illustrated in figure 13, 
was representative of the other augmented modes. A multirate sampling system was 
used, with a major cycle sample time, T, of 30 milliseconds and a minor cycle 
sample time , 3T , of 90 milliseconds . Gimbal angles were transformed to body angles 
by using sines and cosines of gimbal angles updated once every minor cycle , A 
second-order rate estimator operating on these gimbal angles provided body rates , 
which were then filtered. General-purpose digital filters were programed so that 
different characteristics could be selected independently for each feedback parameter. 
Proper selection of the difference equation coefficients could provide a wide range 
of filter characteristics. A first-order prefilter , a dead band, and a parabolic 
nonlinear gradient were available to shape the pilot's input . 


Logic Functions 

An important capability made possible through software was the integration of 
logic statements in the control law code. Logic statements, even though complex, 
were easily written into the software . Had the system been analog rather than 
digital , special-purpose hardware would have been necessary to perform the same 
logic functions , One mode logic function associated with the yaw axis is discussed 
in reference 2 . 

Another type of logic function was the software reasonability test which was 
applied to each surface command before it was sent to the digital -to-analog converter . 
If the new command differed from the previous command by more than a predeter- 
mined amount , the affected axis would have transferred to the direct mode . This 
down mode philosophy was based on the assumption that a reasonability limit would 
be exceeded because of generic failures in the augmentation control laws rather than 
because of a hardware failure which would have affected the direct mode as well . 

It was assumed that a hardware failure would have been detected by the built-in 
Apollo computer fault detection logic . 

Trim inputs were also tested for reasonability before the trim value was updated . 
If a combination of primary trim commands was sensed that corresponded to an 
impossible situation for an unfailed system, a failure was assumed, the primary trim 
was deactivated , and an auxiliary trim system was activated . A test for runaway 
trim was included which disabled trim updates if the trim command persisted for 
more than 3 seconds . 


DIGITAL FLY-BY-WIRE DESIGN 


Design Ground Rules 

Several ground rules were established in order to meet the objectives of the 
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program . First , the airplane was to fly from the first flight without mechanical 
reversion capability . This forced the designers to take the care necessary to 
establish as much confidence in the system , including the software, as would be 
required for future active control applications . Second, the primary digital system 
was to utilize the hardware from the Apollo guidance and navigation system . The 
system was to remain intact; only software changes were allowed . The primary 
reason for this requirement was to retain the system's high degree of built-in 
integrity and reliability . A third basic design ground rule established early in the 
program was to make the pilot's interface with the computer as simple as possible. 

As a result , the pilot was given control over flight control functions rather than a 
direct communication with the computer. All functional changes (for example, a 
mode change) desired by the pilot were to be made through single switch actions. 
This allowed the pilot to perform functional changes rapidly and eliminated the 
possibility of incorrect entry or improper addressing which could have had dire 
consequences close to the ground or at high dynamic pressure. The last ground 
rule was to provide handling qualities that would be judged satisfactory by the 
pilots. A criterion based on C* response to a step pitch stick command (ref. 3) 
was used as a guide during the design of the longitudinal control system . Military 
Specification MIL-F-8785B, level 1, was used during the lateral-directional control 
system design . 

These ground rules had further implications . For example , the interface 
equipment associated with the Apollo hardware established limits on the flight 
envelope for satisfactory operation . The analog-to-digital converter used for pilot 
stick inputs had only 45 usable discrete levels between zero and full stick. In the 
pitch axis each discrete level resulted in a specific level of aircraft normal acceler- 
ation, depending on stick gearing and dynamic pressure. In this instance, the 
acceleration increment became objectionable to the pilot within the basic flight 
envelope. Thus a new flight envelope limit was established at the dynamic pressure 
at which the stick quantization effect was not objectionable. Because of the design 
characteristics of the inertial measurement unit, some additional restrictions were 
placed on the airplane's maneuverability. These included a roll angular rate limit 
of 70 deg/ sec and a pitch attitude limit of 70°. 


Design Synthesis and Analysis 

The closed-loop primary system was synthesized and analyzed by using two 
methods , The first was an analog sample and hold simulation which was useful in 
the learning process in that it pointed out the more general aspects of the digital 
control problem. For example, the acceptable range of sample rate, 25 to 50 samples 
per second , was defined . The effect of the folding phenomenon of sampled-data 
systems on the structural mode frequencies and the influence of common nonlinearities 
were also studied in this design phase . The second method used a digital synthesis 
program which provided linear analysis as a cross check and a background for the 
sample and hold simulation. Basic control laws, compensation, and logic were 
established by using these two methods. A specification for the control law software 
was then formulated, thus providing the basis for coding the flight software. 
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Design Verification and Refinement 


With the delivery of portions of the flight hardware , including the Apollo 
computer and the coupling data unit , and early releases of flight software, design 
verification and refinement was started . A six-degree-of-freedom digital aerodynamic 
model of the F-8C airplane was used in conjunction with the flight hardware to form 
a partial hardware hybrid simulation . 

The first two analysis methods did not consider any pilot interface , but the 
partial hardware hybrid simulation included a lunar module hand controller with 
which the F-8C model could be crudely flown. Coarse input quantization, a problem 
of importance later , did not become evident in this simulation because it was 
completely masked by the characteristics of the hand controller , This is one of the 
major disadvantages of any simulation which does not include major hardware 
elements , 

Another important tool in the design verification and refinement was the batch 
process all-digital simulation. This simulation included the software being verified, 
an Apollo computer emulator, and a program representing the F-8C aerodynamics, 
all run on a large host computer . Powerful plotting routines made the internal 
computer parameters visible during each run . All the control system parameters 
were examined for reasonableness , particularly as they responded to mode and gain 
changes . One of the most useful plots was duty cycle versus run time. A typical 
variation of duty cycle during a maneuver is shown in figure 14 for a roll step . 
Because of some additional code for computation of stick nonlinearities when the 
stick was displaced from zero, additional computational time was required during 
this maneuver. This was reflected in an increase in the duty cycle, as shown in 
the figure . Other contributions to duty cycle were the interrupts from the motion 
sensors . The increase in roll rate produced a loss in available computation time 
roughly proportional to the roll rate . This loss of computation time effectively 
increased the duty cycle . 

The last step in the design verification used the iron bird simulator . One 
problem — the coarse quantization of the pilot’s stick inputs — was uncovered 
immediately. The problem became obvious once the hand controller was replaced 
with the actual center stick. The staircase shape of the computer output commands 
produced sharp responses at the secondary actuators which were unacceptable from 
the standpoint of mechanical motion and structural element excitation . Low-pass 
filtering of the computer output was undesirable because of its adverse effect on 
closed-loop performance. This suggested the use of a digital pilot prefilter that 
had not been anticipated in the control law specifications . The flight software had 
already been substantially verified, but fortunately the read-only memory had not 
yet been manufactured . The prefilter was quickly programed in software and the 
code was reverified . Consequently , there was essentially no effect on the overall 
schedule . This points out one of the significant advantages of a digital flight 
control system: Necessary changes can be made late in the design without affecting 
hardware procurement, packaging, or requalification. Although additional software 
verification will be required, it will not have the adverse effect on program sched- 
ules that is typical of a hardware redesign of an analog system . 

Looking back on the various design and analysis tools , it is apparent that they 
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complemented one another . Confidence in the system grew each time an independent 
simulation or analysis gave results comparable to those obtained previously . The 
importance of having the pilot in the loop with as much actual hardware as possible 
was demonstrated vividly . In terms of time spent on verifying the various aspects 
of the design , the largest proportion was devoted to systematically verifying each 
logic function and mode transfer and the effects of failures. Another time-consuming 
aspect was the refinement of stick gradients and nonlinearities near zero stick . A 
much smaller proportion of time was spent on closed-loop augmentation character- 
istics , probably because of the good agreement generally found between the results 
from sampled-data analysis methods and simulation results . 


RELATIONSHIP TO FUTURE APPLICATIONS 


The configurations of future fly-by-wire systems will probably be strongly 
dependent on the specific missions for which they are designed. As such, each 
system will be unique in some respects , but will have a large degree of commonality 
with other fly-by-wire systems . The F-8 fly-by-wire system was unique in that 
it consisted of a simplex digital primary system , a triplex analog backup system , 
and no mechanical reversion capability . However , in this unique system were 
several features that will be relevant to the systems that will be required to achieve 
the advantages that active control offers. These features were, basically, dissimi- 
lar redundancy , single string software , and the experience associated with the 
digital system design . 


Dissimilar Redundancy 

The F-8 fly-by-wire system experience with two dissimilar systems provides 
information applicable to future systems which are likely to have dissimilar 
redundancy . Most of the problems were concerned with the synchronization of the 
two systems . Transfers from one system to another were handled differently , but 
the goal was to minimize transients caused by the transfer . In each instance, the 
system in control was tracked by the other system so that transients would be 
minimized . However , the primary system tracked the backup system by estimating 
the surface command of the backup system based on the pilot’s control commands 
and trim inputs only . In transfers from the primary system to the backup system , 
the backup system tracked the output of the primary system . Although this 
eliminated the need to reconstruct the primary system signal propagation in the 
backup system , it did open the possibility for unusual initialization conditions when 
the transfer occurred during an abrupt maneuver . Another factor was that a 
transfer from the primary system to the backup system could have been initiated 
automatically as a result of a failure, thus the failure analysis had to consider all 
possible failures that could have resulted in a transfer. The timing of this transfer 
was critical in some instances when it could have coupled with the pilot's normal 
response to cause unacceptable conditions . 

Some aspects of the dissimilar redundant system gave insight into redundancy 
management problems which may be expected in the future . The backup system 
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mechanized the trim function using a digital integrator to reduce drift . Because of 
differences in the sampling mechanisms between the two systems , large errors 
between the two trim signals were noted after extended flight with the backup 
system in control in which numerous trim inputs were made . Figure 15 illustrates 
the two sampling mechanisms . The primary system sampled trim commands every 
90 milliseconds . If trim was being commanded at the time of the sample, the trim 
value was updated in the software. The backup control system did not update its 
digital trim integrator until a capacitor was charged up to a prescribed threshold . 
Although the capacitor began charging the instant the trim button was pushed , 
approximately 175 milliseconds were required before the first update of trim. As a 
result of these two sampling mechanisms , trim inputs of less than 175 milliseconds, 
but greater than 90 milliseconds , caused the primary system , but not the backup 
system , to update trim . To correct the problem , there would have had to be either 
some exchange of actual trim value information between the two systems or some 
form of verification that one system received the trim command before the other 
system updated the trim value. Each of these possible solutions would have required 
additional connections between the two systems , which would have been undesirable 
because they would have created new failure possibilities. For this particular 
research application, a procedural change in conjunction with close monitoring of 
telemetered data in the control room made modification of the system unnecessary . 


Single String Software 

Because a simplex digital system can have only a single program in control at 
one time, it can be described as a system with single string software. However, 
redundant digital systems with the same program in each computer also effectively 
have single string software. The experiences with the F-8 digital system software 
are closely related, then, to the multichannel digital systems expected in future 
civil transports . Generic software failures would have equivalent effects on any 
system with single string software, regardless of the system's redundancy . The 
software controls described in paper 5 suggest that careful verification will always 
be necessary , but that the confidence necessary for man-rating the software can be 
established . 

Another factor that emphasized the importance of man-rated software was that 
the single string software had full- authority control over the control surfaces; thus 
it was obviously flight critical. Digital systems will be called on to perform more 
and more flight-critical functions and, on the basis of our experience, can be 
depended on to perform with high integrity . 

Removal of all mechanical reversion capability before the first flight had a 
significant effect on the entire design and verification process . It forced an 
approach that would establish complete confidence in the system on the basis of 
simulation alone. If the alternate approach had been taken, that of retaining a 
mechanical link, the most probable flight-test procedure would have been to fly to 
a safe altitude using the mechanical system and then engage the fly-by-wire system . 
After confidence was gained at altitude , the more critical flight safety functions , 
such as takeoff and landing , would have been encompassed gradually . 
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Design Experience 


On the basis of the F-8 digital fly-by-wire design experience, several recom- 
mendations can be made regarding the design of digital control systems for future 
civil transports . Many of these recommendations correspond simply to good design 
practice. Analyzing closed-loop performance using standard sampled-data analysis 
techniques such as z-plane root locus can be relied on to give good agreement with 
more complete simulations . Several forms of simulation and analysis should be 
used to build confidence in the system before the first flight . A simulation that 
includes as much actual hardware as possible is important in correctly assessing 
system performance. The interface with the pilot is particularly important. 


CONCLUDING REMARKS 


The feasibility of a digital fly -by -wire system was assessed by replacing the 
mechanical flight control system of an F-8C airplane with a digital primary and an 
analog backup fly-by-wire system. The design and verification procedures which 
will be necessary if flight-critical active control is to be used in future aircraft 
were established and successfully applied as part of the flight program. Careful 
application of standard sampled-data design methods and systematic verification of 
control system hardware and software using complete simulations resulted in a 
digital fly-by-wire system with extremely high integrity. The successful use of 
single string software in a full- authority flight control system demonstrated the 
high level of confidence which can be placed in digital flight control. 

The experience with the F-8 digital fly-by-wire system pointed up several 
factors that will be important in the successful design of future full-time , flight- 
critical digital control systems: 

(1) Batch process all-digital simulation was extremely helpful in tracing 
internal computer variables and in providing visibility to system response during 
mode changes . 

(2) A complete piloted simulation with actual flight control system hardware 
provided important results relative to the pilot/stick interface that had not been 
obtained in earlier simulations which did not include the actual control stick. 

(3) The largest portion of the design and verification effort was devoted to 
logic functions , such as mode transfers , and the effects of failures . 

(4) Software changes made late in the design to correct hardware-related 
problems had a negligible effect on the program schedule . 

A major aspect of the F-8 digital fly-by-wire system which will have application 
to future systems was its dissimilar redundancy. Failure isolation between the 
primary and the backup systems was achieved as desired, although some problems 
were encountered with intersystem synchronization . 
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(b) Yaw-axis damper. 


Figure 2 . Standard F-8C roll and yaw stability augmentation systems . 
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Surface position 



Figure 3. F-8C iron bird simulator . 
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Figure 5 . Location of fly -by -wire control system 
components in F-8C airplane . 


Figure 6 . Mode and power panel 
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Figure 7. F-8 digital fly-by-wire system mechanization. 
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Figure 8. Digital system failure detection and reporting system. 
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Figure 9 . Direct modes for pitch , roll , and yaw axes . 
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3 . MECHANIZATION OF AND EXPERIENCE WITH A 


TRIPLEX FLY-BY-WIRE BACKUP CONTROL SYSTEM 

Wilton P. Lock and William R. Petersen 
NASA Flight Research Center 

and 

Gaylon B . Whitman 
Sperry Flight Systems Division 


SUMMARY 


A redundant three-axis analog control system was designed and developed to 
back up a digital fly -by-wire control system for an F-8C airplane. Forty -two 
flights, involving 58 hours of flight time, were flown by six pilots. The mechaniza- 
tion and operational experience with the backup control system , the problems 
involved in synchronizing it with the primary system , and the reliability of the 
system are discussed . 


The backup control system was dissimilar to the primary system , and it pro- 
vided satisfactory handling through the flight envelope evaluated . Limited flight 
tests of a variety of control tasks showed that control was also satisfactory when the 
backup control system was controlled by a minimum-displacement (force) side stick . 

The operational reliability of the F-8 digital fly-by-wire control system was 
satisfactory , with no unintentional downmodes to the backup control system in flight . 
The ground and flight reliability of the system's components is discussed. 


INTRODUCTION 


A control system consisting of a primary digital fly-by-wire system and a dis- 
similar triplex analog backup system was flight tested in an F-8C airplane by the 
NASA Flight Research Center . The mechanical linkages of the original F-8C control 
system were removed except for cockpit stick and pedal centering and feel . A 
single channel digital computer , the associated electronics , a power-generating 
system , and electrohydraulic secondary actuators made up the primary control 
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system . A triplex backup control system provided the redundancy required for 
manned flight and gave the total system two -failur e-op er ate reliability . 

The main components of the backup control system were the sensors, the elec- 
tronics, and the secondary actuators. The system was analog for signal processing, 
had no feedback for stability augmentation , and was designed to provide emergency 
return-home capability with airplane handling qualities equal to those of the basic 
F-8C airplane. The F-8C airplane can be flown through most of its flight envelope 
without augmentation . 

This paper describes the backup control system and its integration with the 
primary control system , which is described in detail in paper 2 . The mechanization 
of and operational experience with the primary and backup control systems are 
discussed . Some aspects of the primary and backup control system design were 
unique; however , many of the design features would apply to fly-by-wire control 
systems in active control aircraft. The reliability of the total system during the 
program is described. 

A limited flight test evaluation of the backup control system was conducted using 
a minimum-displacement (force) side stick controller for pitch and roll control. 
These evaluations represent most of the maneuvering experience with the backup 
control system. 


DESIGN FEATURES 


The backup control system was designed to provide redundancy for the F-8 
digital fly-by-wire control system . It was a triplex analog fly-by-wire control- 
stick-to-control-surface system in which the electronic trim, sensor and electronics 
equalization, primary control system synchronization, and servo and electronics 
monitoring were independent of the primary control system . The system incorpo- 
rated several innovations that are common in modern electronics equipment but not 
as common in airplane control system hardware . These design features are 
described in the following sections . 

A functional block diagram of the F-8 digital fly-by-wire control system is pre- 
sented in figure 1 . The upper portion of the figure is the primary control system , 
and the lower portion is the backup control system . The secondary actuators are 
shared between the primary and backup systems , and the primary control elec- 
tronics provide the interface between the digital-to-analog converters of the primary 
system . The secondary actuators and the synchronization between the primary and 
backup systems are also discussed in this paper . 


Triplex Channels 

The backup control system consisted of three identical computing channels , 
one for each airplane control axis. The system provided an interface between the 
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triplex control stick and pedal position sensors and the triplex servovalves . In 
addition , the three backup control system channels , including the sensors , elec- 
tronics , and servos , were powered by three isolated power busses that were 
connected to a common power source. 

The servo commands , which consisted of stick and pedal commands that were 
summed with the trim and equalization signals , were processed by voters in each 
channel to insure that the three backup channels tracked . The voter selected the 
middle value of the three channel commands to drive the control valve in each 
channel. For certain types of failures in the voter , actuator , or servo electronics , 
the failed channel would be detected and the servovalve associated with the failed 
channel would be disengaged. Therefore, the backup control system was opera- 
tional after one or more failures . 


Synchronization 

An integrator in each axis of the three backup control system channels provided 
electronic trim , equalization , and synchronization . When a primary channel was 
engaged, the backup control system servo commands were synchronized with the 
primary servo commands with these integrators . These inputs to the backup con- 
trol system voters tracked the primary channel servo commands , even though 
variations in control sensor outputs and in intersystem control laws existed. Con- 
tinuous synchronization of the backup with the primary control system was neces- 
sary to minimize control surface transients during the switchover from the primary 
to the backup control system. Switchover occurred if there was a failure in the 
primary system or if disengagement was commanded by the pilot . The synchroniza- 
tion network had a bandwidth of approximately 2 .5 hertz . 


Equalization and Trim 

When the backup control system was engaged, the integrators performed the 
backup control system trim and equalization function. Trim was accomplished by 
applying a fixed reference to the integrator , changing trim at a fixed rate . The 
integrator output was then summed with the control stick or pedal position inputs 
to form the total surface command. Since the trim inputs, sensor position inputs, 
and electronic gains were not necessarily the same in each backup control sys- 
tem channel, equalization was included to reduce errors between channels. Limited 
equalization, combined with the voters, produced essentially identical channel 
servo commands to the three backup control system servovalves and minimized the 
force fight between the secondary actuator pistons . 

The trim and equalization functions required a low or zero drift integrator . 

The backup control system integrator design , which was classified as having zero 
drift , used digital techniques to accomplish the zero drift or memory function and 
analog techniques for the integration function . 
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Backup Control System Monitoring 


Electronic and servo signals were monitored at two points within the backup 
control system . The channel voter output was compared with the voter input . If 
the signal difference was greater than the set threshold , the monitor was latched and 
the electronic channel was reported failed . 

The other monitoring point was the backup control system servos . Backup con- 
trol system servo monitoring was accomplished by cross-channel comparison of the 
differential pressure signals from each of the three servovalves. This detected ex- 
cessive force fights within the backup control system servos. A preset difference 
in two of the three differential pressure signals resulted in latching the common 
servo monitor, disengaging the failed servo, and reporting the failure to the pilot. 
When a failure was detected and the failed servo disengaged , the resulting surface 
transient was minimized by the operating characteristics of the force-summed 
actuator . 


Self- Test Procedure 

Preflight testing was accomplished by an automatic self-test procedure that 
provided a pseudo-end-to-end testing of the system. The self -test involved the in- 
troduction of a logic-controlled stimulus and the disabling of circuit functions and 
used in-flight monitors to indicate the response . The use of the in-flight monitors 
as the self -test feedback elements served to check the channel signal paths and the 
operation of the in-flight monitors . This resulted in a "bang-bang" type of test with 
no indication of system degradation. 

A block diagram of the self-test unit is shown in figure 2 . The power for the 
self -test was routed to the computing electronic assemblies only after the self-test 
power switch was closed and the self-test start switch was depressed . A counter 
started to count and addressed the read-only memory , which was preprogramed for 
each particular test to activate certain stimuli and disable certain circuits in the 
electronic assemblies. The test results were compared with the predicted results , 
which were stored in the read-only memories in the diagnostic analysis circuitry . 
The self-test automatically stepped to the next test if the test results were as pre- 
dicted . This procedure was repeated with different combinations of stimuli and dis- 
abling circuits active until the test was complete and a GO signal was reported in 
each airplane control axis . 

If the test results from the electronic assemblies were not as predicted , the 
test sequence was stopped and a diagnostic routine was initiated . The diagnostic 
analysis circuitry analyzed the test results with respect to the predicted results to 
determine where the failure occurred . The diagnosis was indicated on the self-test 
diagnostic readout . 


Status Engage Panel 

The status engage panel was in the left cockpit console . It housed all the 
servo engage switches and servo status lights and indicated the status of the 
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backup control system electronics . The panel also contained the self-test program , 
power switch , and diagnostic readout to indicate a failed self-test condition or satis- 
factory completion of the self-test . The servo switches were three -position positive- 
action switches labeled Auto-Off and Manual . Even though five secondary actuators 
were utilized for the three control system axes , only three switches and servo status 
lights were used for the three primary control channels , whereas individual channel 
switches and status lights were mechanized for each backup control valve . The 
lights indicated when the various comparator networks had exceeded preset values. 
The light was also a reset switch that sent a reset pulse to its comparator . The 
servo status lights for backup servo systems 2, 3, and 4 lit up after any two common 
comparators tripped. That is, the left pitch 2-3 comparator and the left pitch 4-2 
comparator lit the left pitch number 2 light when both comparators tripped. The logic 
for the primary control system pitch servos was that if either the left or the right 
pitch channel indicated failure, the number 1 pitch status light lit, and control was 
switched from the primary to the backup control system . The servo system logic 
was designed to provide a manual override capability for any channel per actuator 
regardless of the remaining servo system switch positions. 


SYSTEM COMPONENTS 


The approximate locations of the control system components in the F-8 digital 
fly-by -wire test airplane are shown in figure 3 . As might be expected , using the 
F-8C airplane as a test-bed resulted in some design problems that were unique to 
the F-8C configuration, A major problem was the requirement for different control 
gearing for the wing-up (approach and landing) and wing-down (cruise) positions . 
A pair of dual wing potentiometers was mounted to provide an electrical signal pro- 
portional to wing position to droop the ailerons for flaps and to provide automatic 
trim of the horizontal tail . Other system components that provided control , signal 
conditioning , and actuation are described below . 


Control 

Stick and pedal transducers. — Two transducers that each contained triplex 
redundant linear variable differential transformers (LVDT's) were connected to the 
existing F-8C flight control linkage to provide electrical signals as functions of the 
pilot's stick and rudder commands. One transducer was provided for the primary 
control system , and one was provided for the backup control system for each air- 
plane axis of control. The pitch transducers were on the right and the roll trans- 
ducers were on the left side of the airplane underneath the primary flight pallet. 
Because of rudder cable stretch, the two rudder transducers were installed in the 
base of the vertical tail . 

Each transducer assembly contained isolated sensors for excitation and signal 
output to drive as many as three separate control paths. All the transducers were 
linear , except for the pitch transducers for the backup control system , and all had 
an electrical stroke of ±1.5 centimeters. The pitch transducer for the backup control 
system transducer had a special winding to provide parabolic stick shaping. 
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Stick and pedal gearing. — An attempt was made to duplicate the control author- 
ity and gearing of the original F-8C airplane in the F-8 digital fly-by-wire airplane . 
The final gearings are shown in figures 4(a) to 4(e) for the pitch, roll, and yaw 
axes . 

The data presented in figure 4(a) indicate that there was reasonable agreement 
between the pitch stick gearing of the fly-by-wire airplane and that of a conven- 
tional F-8C airplane. Only the wing-down data are presented for zero trim command. 
With the wing in the up position , the horizontal stabilizer surface was biased 5° from 
the wing-down position, and the zero stick position corresponded to zero surface 
position . 

Figure 4(b) shows the left aileron position as a function of lateral stick position 
for a wing-down and a wing-up configuration with zero trim command . The gra- 
dients are nearly the same for all backup control system commands except for the 
wing-up right stick command , where the gradient is higher than in the conventional 
F-8C airplane. The fly-by-wire gradients were symmetrical for both wing positions , 
whereas the wing-up gradient was not symmetrical (differential aileron) for the con- 
ventional F-8C airplane . The aileron did not move down as far as it moved up for a 
given stick command . 


Figure 4(c) shows rudder displacement as a function of pedal force. Gradients 
are shown for the wing-up and the wing-down configurations . The higher gradient 
was used with the wing-down configuration. The pedal forces were provided by the 
existing F-8C mechanism. The gradients show good agreement for both wing posi- 
tions . The backup control system deadband was slightly larger . 

Side stick. — The side stick sensor flight tested during the program was a two- 
axis, four-channel, minimum-displacement transducer. The principal of operation 
for the transducer was that an applied force at the stick grip caused a flexure- 
supported tube assembly to move quadruplex LVDT’s that generated a voltage pro- 
portional to the applied force. The side stick transducer was recessed in the right 
cockpit console to allow the pilot to sit comfortably in the seat with his arm in a 
natural position . 

Side stick gradients. — The side stick gradients flight tested are shown in fig- 
ures 5(a) and 5(b) for the pitch and roll axes, respectively. Figure 5(a) shows 
the pitch stick force as a function of elevator surface position for both wing posi- 
tions . The circuit mechanization consisted of a deadband , a low gradient , and a 
high gradient for both a pull and a push force. The variable high gradient was 
mechanized to function only with the wing down , and it was controlled by a switch 
in the cockpit. In figures 5(a) and 5(b) , switch positions increase with increasing 
stick gradient . The side stick authority was always less than the center stick 
authority. 


Electronics 

Backup control system. — Three identical backup control system electronics 
boxes were the heart of the backup control system . Each box contained all the 
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signal processing , engage logic , monitoring , and de power necessary for a single 
backup control system channel in the pitch, roll, and yaw axes. A block diagram 
of a single channel in the roll axis (channel 3) is shown in figure 6 . Except for 
scaling , trim rate , and the gearing change with wing position , the network for the 
pitch axis was basically the same . The yaw axis differed in scaling and trim rate , 
and a limiter was added just after the voter . The voter output drove only one 
actuator network . 

Figure 6 shows one electrical comparator across the voter and a single compara- 
tor across each backup valve . In total , there were eight comparators per backup 
control electronics box . The trip level of the electrical comparators was set at 
3 . 0 volts , which was approximately one-third the maximum voltage for each axis . 

This corresponds to a stick displacement of approximately 2 . 5 centimeters for roll 
and 5 centimeters for pitch. The differential pressure comparators were set to trip 
at 2.4 volts, which represents a differential pressure error of 8273 kN/m 2 . 

Primary control electronics . — The primary control system electronics box con- 
tained the signal interface between the computer's digital-to-analog converter outputs 
and each secondary actuator for the airplane's pitch , roll, and yaw axes . A simpli- 
fied block diagram of a typical primary signal circuit is shown in figure 7. For each 
control axis, there were two identical signal paths, the active and monitor channels, 
from the computer to the control valves of the respective secondary actuator . The 
primary control electronics box contained two 5-hertz second-order smoothing 
filters in each of the three axes. Follow-up signals from the secondary actuator 
were biased with the wing position voltage for the pitch and roll actuators. The 
signal was then divided for summing and sent directly to the monitor servo amplifier 
or quadruplex voter and processed with the three comparable signals from the back- 
up control system . In conjunction with the hydrologic comparator , this provided 
hard-over protection from open servo follow-up signals. 

The primary control electronics box also contained engage logic , monitoring , 
and the dc power supply for the box and the primary secondary actuators . A 
separate return comparator was used to monitor the difference between comparable 
points in each axis of the primary and backup control systems. When the error was 
greater than 3°, 4°, and 3° for the elevator, aileron, and rudder, respectively, the 
primary control system could not be engaged . However , the backup control system 
could always be selected . 

Side stick electronics . — The installation of a side stick required additional 
electronics that could not be readily added to the backup control electronics boxes. 
Therefore, the additional electronic networks needed to provide demodulation, 
deadband, shaping, and gradient (fig. 8) were mechanized to interface between the 
side stick transducer and the backup control electronics boxes. The triplex elec- 
tronics concept was maintained from sensor output to the appropriate channel sum 
points in the backup control electronics boxes . 


Secondary Actuators 

The secondary actuator (fig . 9) was a four-channel electrohydraulic actuator 
designed to convert electrical signals to surface motion and to have two-fail-operate 
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capability . There were five secondary actuators: two for roll , two for pitch , and 
one for yaw . The mechanization of the secondary actuator was an active/ standby 
configuration which consisted of two valves in the active configuration and three 
valves in the standby configuration . The secondary actuator was designed to be 
controlled by any of the four electrohydraulic control channels . Each primary 
channel commanded one active valve to position the actuator; the second valve, in 
conjunction with the hydrologic failure detection network , was used for self' 
monitoring . The actuator standby or backup channels commanded by the backup 
control system consisted of three force-summed channels with electronic failure 
detection . 

Two-stage flapper nozzle servovalves were used for the primary system active 
and monitor valves . During normal operation , these valves received separate 
commands, and the active valve positioned the actuator ram as required. The fail- 
ure detection for the primary control system was provided by a hydraulic comparator 
network. A comparator spool was balanced between the force exerted by two 
springs and the output pressures from the active and monitor spools. If a pressure 
difference beyond a predetermined threshold existed, motion of the comparator 
spool dumped the supply pressure to the return line, which caused the primary 
engage valve to reposition and block the commands from the active servovalve . 

Errors that could cause the hydrologic comparator to trip were measured in terms of 
either single control surface deflection or commanded current. These were 4°, 4°, 
and 1.5° for the elevator, aileron, and rudder control surfaces, respectively, or 
one-half the maximum valve current . 

A dual pressure switch was installed in the primary hydraulic circuit of each 
secondary actuator to sense minimum pressure. The switch caused the primary servo 
system to disengage at 4137 kN/m 2 , and a pressure of at least 5516 kN/m 2 was re- 
quired for manual reengagement, When the primary channel tripped, the pressure 
switch opened , which caused the engage logic to automatically energize the three 
solenoids in the backup control system and to transfer control to the three single- 
stage jet pipe servovalves (servo systems 2,3, and 4) . 

The backup system servos were monitored by differential pressure transducers 
that were installed across the output legs of each jet pipe servovalve. Each differen- 
tial pressure signal was compared with the other two differential pressure signals 
for each actuator . The comparison was made in the backup control electronics boxes . 

The secondary actuators were modular in construction and were designed around 
three tandem pistons on a common shaft. The primary channel and one backup con- 
trol system channel shared one of the piston networks , and the remaining pistons 
were controlled by the other two backup systems. Each secondary actuator was 
supplied by two separate hydraulic systems. Figure 9 shows the secondary actuator 
mechanization in the primary configuration . 

The figure shows that the valve outputs of backup channels 2 and 4 were blocked 
by separate hydraulic engage valves and that the cylinders bypassed fluid as the ram 
moved. Backup channel 3 was blocked by an engage valve with a slightly different 
design . 

The servo position loop was closed electrically for each channel in the elec- 
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tronics boxes . The electrical signal utilized for the servo ram position came from 
the quadruplex redundant LVDT in each servo actuator shaft. The stroke of all the 
secondary actuators was 5 centimeters , and by utilizing the necessary mechanical 
linkage, the desired control surface rotation was obtained for all five surfaces. 

Response characteristics . — Ground test data were taken for each actuator with 
different valve combinations. The performance of each secondary actuator was a 
function of the engaged servovalves . The primary valves had much higher re- 
sponse than the valves used in the backup servo systems (systems 2, 3, 4) , but 
because of hardware problems (ref. 1) the primary servo amplifier gain was 
lowered . 

A typical frequency response curve of the elevator secondary actuator with the 
primary servovalve in control is shown in figure 10. The figure compares the flight 
tested servo amplifier gain , 5 milliamperes per volt , with the designed servo ampli- 
fier gain of 22 milliamperes per volt. Even though the pitch servo bandwidth flight 
tested was 6 hertz , the addition of a second-order filter reduced the effective servo 
bandwidth to 2 .5 hertz . The total bandwidth of the filter , secondary actuator , and 
elevator power actuator was 1 .5 hertz for an elevator surface amplitude of 1° peak 
to peak , normalized at 0 . 5 hertz , 

The frequency response of the same pitch secondary actuator when controlled by 
the backup control system valves is shown in figure 11. Data are compared for two 
valve drive configurations . One data set was obtained with a single backup control 
system channel valve in control of the secondary actuator . The other data set was 
obtained with all three backup valves in control . The single backup control system 
channel bandwidth was 7 hertz , and the bandwidth of the three backup control sys- 
tem channels was 13 hertz. All three backup control system channels per airplane 
control axis had the same servo loop gain, which indicates that the performance in- 
crease was a result of the force summing of the secondary actuator pistons . 

Hysteresis . — Hysteresis measurements were also taken for each secondary ac- 
tuator for the various valve drive combinations . The data were obtained by driving 
the appropriate servovalves with a signal generator set at 0.01 hertz. For example, 
the hysteresis of the elevator secondary actuator for the primary channel (fig. 10) 
was 0.44°. By increasing the loop gain, this value could be reduced to 0.13°. The 
equivalent measurements for the two backup control system conditions presented in 
figure 11 are 1.10° for the single-channel drive configuration and 0.47° for the 
three-channel drive configuration . 

A minor item of interest pertaining to the secondary actuators was observed dur- 
ing single channel operation with the backup control system . Even though the elec- 
trical commands to each paired surface, such as the aileron and elevator, were the 
same, the control surfaces did not track each other during large control cycles. 

This was caused by the component offset characteristics in the servo loop as well as 
by the seal friction of the respective actuator channel . A given servo system took 
more current to retract the ram for the left control surface than the right control 
surface and less current to extend the left than the right . From outside the airplane 
the control surfaces did not appear to track. This was most noticeable with the ele- 
vator surfaces. This condition existed with every actuator, and there was no way to 
adjust the offset. When additional servo systems were engaged, the condition was 
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minimized and the agreement between the deflections of the paired surfaces was good . 

The condition was not apparent with the primary control system engaged 
because of the higher bandwidth servovalve and pressure gain. 


Electrical Power 

The electrical power for the operation of the F-8C aircraft was supplied by the 
main generator power package . This unit was comprised of ac and dc brushless 
generators that were mounted on a common shaft, regulators for the generators, an 
air turbine motor, and the necessary reduction gears. Energy for the turbine was 
supplied by high pressure bleed air from the engine. The ac generator was rated at 
12 kilovolt amperes at 115 volts and 400 hertz. The dc capacity was 68 amperes at 
30 volts. An emergency power package supplied backup electrical power as well as 
a hydraulic pump driven from a ram air turbine . The capacity of this unit was 
30 amperes of dc and 4.2 kilovolt amperes of 400-hertz power. Figure 12 shows the 
power distribution system of the F-8 digital fly-by-wire airplane. 

The power requirements of the fly-by-wire system were determined by the char- 
acteristics of the Apollo equipment . This equipment limited the ripple , spike , and 
surge voltages on the nominal 28-volt bus to a maximum of 32.5 volts and a minimum 
of 24.5 volts , with a peak current demand of 60 amperes. These requirements , in 
addition to a requirement for an estimated 30 amperes for the backup control system , 
made it necessary to install an additional power source in the airplane. Therefore, 
a direct-drive, 100-ampere, 32-volt dc flight control system generator was mounted 
in the nose cone of the engine . The voltage regulator was set to provide 28-volt 
power at the primary (number 1) bus . To give the additional protection required by 
the Apollo equipment, zener diodes and a 55,000-microfarad capacitor were placed 
on the number 1 bus . Flight control system power was controlled from the cockpit 
through normally closed power relay contacts . A warning indicator informed the 
pilot of loss of generator power . 

To provide the necessary redundancy , 28-volt power was divided into four sep- 
arate busses by isolation diodes and circuit breakers (fig. 12) . Each bus , one for the 
primary system and one each for the triply redundant backup control system , had a 
24-volt, 11-ampere-hour nickel cadmium battery as an alternate source of power. 
Backup control system batteries were always on the line , and they were kept fully 
charged by a constant trickle charge. They could provide power for a minimum of 
1 hour after the loss of the flight control system generator . For additional protection , 
it was made possible for the pilot to place the main dc generator on the backup control 
system busses with normal loads reduced. To assist the pilot in monitoring the con- 
dition of the backup control system battery , a battery capacity meter was installed in 
the cockpit. This device measured current flowing into or out of the battery in 
terms of percent of full charge. It was not intended for the number 1 battery to 
supply the primary system with power for more than a few minutes . Its sole purpose 
was to aid in the stabilization of the bus voltage and to allow operation during tem- 
porary power interrupts like those that occurred during bus switching. For the pro- 
tection of the number 1 battery, a circuit was installed to remove the battery from the 
bus whenever voltage dropped below 20 volts. 
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OPERATIONAL EXPERIENCE 


The first operational experience with the F-8 digital fly-by-wire control system 
was acquired during the integration and checkout of control system components in an 
iron bird simulator (paper 2) . The simulator was used to fine tune the control sys- 
tem to give it the necessary authority , trim rates, servo loop gains, and comparator 
trip levels. Before the first flight, the entire flight control system was subjected to 
an extensive ground test program that lasted 7 months . During this period , two 
major hardware changes were made. Because of the nonlinear characteristics of the 
Apollo hardware (ref. 1) unacceptable noise was transmitted to the secondary 
actuators. A second-order filter network was installed to smooth the primary system 
electronics. The backup control system integrators were changed to digital from 
analog because of drift . 


Backup Control System Flight Evaluation 

Before the first flight, the backup control system was tailored. to the primary 
channel gearing and trim rates in each airplane axis . The flight controllability of 
the primary control system and the backup control system was evaluated on the sim- 
ulator . Since the sole purpose of the backup control system was to provide an emer- 
gency return-home capability if the primary system became inoperative , the flight 
testing of the backup system was minimal . The testing did insure that the backup 
system would provide acceptable controllability, and at least once per flight the F-8 
digital fly-by-wire control system was downmoded to the backup control system to 
perform an inertial measurement unit alinement. This was done in level flight. 

Center stick . — The piloting tasks used to evaluate the backup control system 
with the center stick paralleled those used to evaluate the primary control system in 
the direct mode. The evaluation maneuvers included routine flying while evaluating 
gross and fine control maneuvers, formation flight, and gunsight tracking. The 
low-speed evaluations included ground control approaches. The first flight evalua- 
tion took place at speeds between 275 and 300 knots indicated airspeed with routine 
flying maneuvers . The pilot comments indicated that roll response was adequate 
and pitch control was good at these flight conditions . The airplane also exhibited 
satisfactory handling qualities and control power in the landing approach . During 
subsequent flights , the airplane seemed sensitive in the roll axis , and in a more 
demanding control task , that is , formation flight , the pilot indicated that airplane 
roll response became too oscillatory (paper 7) . He assigned the task a pilot rating 
of 6 on the Cooper-Harper scale (ref. 2) . The lateral sensitivity problem was 
reduced by adding electrical deadband to the roll stick command signals . The 
modification yielded the roll gearing shown in figure 4(b) . Even though the backup 
control system roll gearing was approximately the same as that in a conventional 
F-8C airplane, some pilots commented that the airplane rolled a little faster than 
they liked for a given stick displacement at 300 knots indicated airspeed. However, 
they felt that the roll response was not overly sensitive. A viscous damper was 
added to the aileron stick linkage to improve the dynamic stick characteristics for 
both the primary and the backup control systems . 
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For the first eight flights of the F-8 digital fly-by-wire airplane , a linear trans- 
ducer was used in the pitch axis of the backup control system . As flight speeds 
increased, a longitudinal sensitivity problem was observed by the pilot in both the 
primary and the backup control systems . This problem was solved by reducing the 
slope of the curve around zero but maintaining the previous control authority . Be- 
cause of the inflexibility of the design of the backup control electronics boxes , non- 
linear characteristics were obtained by having a stick transducer manufactured that 
was similar to the original but gave the desired curve shape . The pitch modification 
and appropriate scaling change in the backup control electronics boxes resulted in 
the backup control system pitch gearing presented in figure 4(a) . Subsequent flight 
evaluations indicated that control was satisfactory in cruise as well as in the landing 
approach. In normal flight, the airplane's control characteristics with the backup 
control system were similar to those in the primary control system's direct (unaug- 
mented) mode . For maneuvers that required large changes in pitch , however , such 
as gunsight tracking during windup turns , the pilots preferred the backup control 
system to the primary control system because of its smoother pitch response . The 
characteristics of the primary channel were poorer because of stick quantization 
(paper 6) . 

The trim switches for the backup control system pitch and roll axes were on the 
left cockpit console just forward of the throttle control. During the evaluation of 
the backup control system , it became apparent that the location of the trim switches 
was undesirable. One pilot rating was at least one number higher (poorer) because 
of the additional workload due to this location . Beginning with the side stick evalua- 
tion phase of the flight testing , the backup trim was activated from the conventional 
center stick trim switch. 

Side stick. — The side stick was evaluated primarily by two pilots during six 
flights . Six other flights were flown by four pilots who were evaluating other fea- 
tures of the control system . Although the side stick gradients were not optimized , 
the side stick controller was considered to be of interest in the overall control sys- 
tem evaluation. Side stick evaluation tasks included formation flight, gunsight 
tracking, mild aerobatics, ground control approaches, landing, and takeoff. Since 
takeoff was considered the most uncertain phase of flight , it was performed only 
after side stick control was evaluated in a high pilot gain task during up and away 
flight. During the 12 evaluation flights, three takeoffs and seven landings utilizing 
the side stick controller were made. 

The stick gradients selected for flight test were based upon the six-degree-of- 
freedom simulation results obtained with the iron bird simulator . The stick-to- 
surface gradients were selectable , as shown in figures 5(a) and 5(b) . The wing- 
down gradients selected by most of the pilots were position 1 in pitch and position 3 
in roll. The roll gradients were not changed during any of the flights, whereas a 
slight change was made in the pitch axis . The original transition , or knee , of the 
curve between the low and high gradients was at approximately 36 newtons , and 
this value was increased to approximately 57 newtons for the last three flights. 

All the pilots adapted easily to the side stick controller in flight after practice 
on the simulator . They all 'commented on the sensitivity of the pitch axis , particu- 
larly in high pilot gain tasks like formation flight. The center stick was also some- 
what sensitive, but the excursions were lower in amplitude. Some of the pilots 
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tended to fly both pitch and roll with a pulsing type of input , Most pilots tended to 
hold a nose-up stick force during the various maneuvers. The value they used was 
approximately 23 newtons , which was outside the stick deadband . One of the six 
pilots noted arm fatigue after a flight in which he evaluated side stick control. Sev- 
eral pilots rated the formation flight control task 3 to 5 . 

As discussed in paper 7, gunsight tracking was typified by good to excellent 
control over the lateral-directional axis and continuous pitch oscillations caused by 
pitch commands that were too abrupt . Crosstalk was absent in the tracking task . 

A comparison between a side stick-controlled and a center stick-controlled tracking 
run showed a higher frequency output from the force side stick , indicating a higher 
pilot workload . 

The wing-up stick force gradients were evaluated in the power approach con- 
figuration for pitch out maneuvers and ground control approach patterns . Many of 
the approaches were flown in light turbulence, which seemed to have little adverse 
effect on control , Pitch and roll control was adequate , and pilot ratings ranged 
from 2 to 4 for the landing approach task . 


Synchronization Performanc e 

An important design requirement for a backup control system is that it track 
the primary system closely to minimize the switching transients. Therefore, syn- 
chronization networks were used to keep the systems synchronized. During every 
flight , the primary system was downmoded to the backup control system at least 
once to aline the inertial measurement unit in level flight . 

Thus , downmoding to the backup control system was checked approximately 
40 times. The surface transients were always less than 1°. The transients observed 
during these downmodes were caused primarily by the differences in null between 
the primary and the three backup servovalves of each secondary actuator. Overall, 
the system's static performance was good. 

Simulation studies on the iron bird simulator showed that the synchronization 
network bandwidth of 2 . 5 hertz provided satisfactory backup control system track- 
ing of the primary system for all except abrupt stick commands. The simulator 
studies also indicated that the synchronization/ trim network characteristics could 
produce a large out-of-trim condition during a dynamic downmode if stick or pedal 
commands were being applied . The corrective action was to trim out the stick or 
pedal signal present at the time of the downmode. 


Trim 

The backup control system was mechanized with a digital integrator for trimming 
the backup control system and for synchronizing the backup control system with the 
engaged primary system. Since the control systems had to be synchronized over the 
full authority of the control surfaces , the integrator had to be scaled for full control 
authority. This resulted in an integrator resolution of 0.18°, 0.30°, and 0.20° for 
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elevator, aileron, and rudder, respectively. Trimming a control surface became 
a stepping operation and was not precise. 


Hydraulics 

The conventional F-8G hydraulic systems were not changed except for the addi- 
tion of the F-8 digital fly -by-wire secondary actuators. Two hydraulic pumps each 
delivered a maximum of 45 liters per minute at a nominal pressure of 20,684 kN/m 2 . 
This capacity was marginal during two operations . At idle power , the hydraulic 
flow was inadequate to support preflight self-tests. A power setting of 80 percent 
proved to be satisfactory and was used for airplane ground checks. The self-tests 
were designed to operate in all three axes or one axis at a time. The latter proce- 
dure was used most often, although the three-axis tests were completed in approxi- 
mately 4 minutes . During landing at idle power , high control surface activity 
caused the hydraulic pressure to drop, which caused the secondary actuator pres- 
sure switches to downmode the F-8 digital fly-by-wire system from the primary to 
the backup control system . This occurred during two landing rollouts , but no con- 
trol system transients were observed by the pilot . 


CONTROL SYSTEM RELIABILITY 


The primary and backup control systems operated approximately 2500 hours 
during the fly-by-wire program, including both aircraft and iron bird operation, 
without any major problems . Six evaluation pilots flew the F-8 digital fly-by-wire 
airplane 42 times for a total flight time of 58 hours. Because of its length, the pro- 
gram was not expected to establish a level of confidence in fly -by-wire control sys- 
tems , but it did constitute a first step toward developing such confidence. From 
the first flight , the airplane was flown with a control system that had no mechanical 
backup or reversion capability , During the evaluation flights , there were no sys- 
tem failures that could be attributed to the fly-by-wire aspect of the digital flight 
control system . There were no electronic failures in flight in either the digital 
primary system or the backup control system . There was one hydraulic line failure 
that reduced the total system redundancy level from four channels to two channels , 
but flight was no more critical than it would have been if a similar failure had 
occurred in a standard F-8C airplane. This is discussed in more detail below . 

In addition to the reliability of the total system , it is important to discuss the 
reliability of the elements of the system . Table 1 summarizes the discrepancies that 
occurred in the F-8 digital fly-by-wire control system. The table includes the dis- 
crepancies experienced with the iron bird simulator as well as those experienced 
with the F-8 digital fly-by-wire airplane . Discrepancies observed during ground 
operation, preflight testing, and in flight are listed by major system component. A 
discrepancy was any system operation that appeared to be abnormal. Some were 
minor transient effects that did not affect the system's performance or reliability. 
The number of discrepancies that required a repair or replacement action is indi- 
cated . Even if no repair wa,s required , extensive tests were made to insure that the 
component in question performed as designed . 
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The discrepancies listed for the computer and related hardware, which are dis- 
cussed in paper 6 , are listed here to present an overview of the operational prob- 
lems encountered during the program A coolant system designed specifically for the 
Apollo system used on the F-8 digital fly-by-wire airplane caused one flight to be 
canceled before takeoff and one flight to be terminated early. The coolant system 
problem was attributed to lines that were frozen and did not permit the coolant to 
flow through the cold plates. When this occurred in flight, the coolant system was 
being monitored and the flight was terminated before it affected the control system . 
The pilot continued to fly on the digital primary system , and four channel redun- 
dancy was retained through landing. This problem was unique to the Apollo equip- 
ment and therefore would not be expected in production fly-by-wire systems. 

Three power turn-on problems were observed, two with the backup electronics 
and one with the primary electronics. On one occasion , measurements indicated that 
the voltage supply for the primary electronics was not present . Recycling the power 
switch brought the power supply on line , and during subsequent testing the problem 
did not reappear . Laboratory testing did not reveal the cause of the problem , but a 
similar power turn-on indication was obtained by grounding either the plus or minus 
power supply. 

Six failures due to open buffer resistors were recorded in the primary and back- 
up electronics early in the program. It was discovered that the resistance wire in 
these resistors was affected by chemical or electrolytic corrosion. All the buffer 
resistors were replaced by a different type of resistor, and no other problems of 
this type were encountered . The other component failures listed were caused by an 
intermittently functioning capacitor, a failed zener diode, and an open transistor. 
None of these occurred in flight , and all were detected through normal testing pro- 
cedures. During the flight program there were 12 backup electronic comparator 
tripouts, but the redundancy level of the total system was not affected. Ground 
checkout indicated that there were no failed components. 

The secondary actuator discrepancies consisted of component failures , problems 
related to differential pressure, and differential pressure comparator tripouts. With 
25 servovalves, 20 engage solenoids, and 20 differential pressure transducers in the 
airplane , occasional problems were expected . The servovalve was the only second- 
ary actuator component to fail . Three such failures occurred in the aircraft system . 
They were detected during ground tests and repaired . If such a failure had occurred 
in flight it would have caused the loss of one of the four actuator channels . 

As the table shows , the largest number of discrepancies occurred in the second- 
ary actuator differential pressure network. Four aborted takeoffs were charged 
against the differential pressure network, as well as four in-flight and 26 preflight 
differential pressure comparator tripouts. Most of these discrepancies were classi- 
fied as nuisance tripouts and occurred during control cycles whenever the primary 
system was engaged. All comparator tripouts were resettable by the pilot, and the 
total system's redundancy was not affected. Generally speaking, most of the differ- 
ential pressure problems experienced were caused by a tracking error between the 
various differential pressure signals , which caused the servo comparators to trip . 
This frequently occurred at the maximum travel of the actuator, where the differen- 
tial pressure signals were the highest . These nuisance tripouts were caused by a 
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combination of the various components' tolerances and valve nulls, and were pre- 
dictable for certain stick motions. The problem could be resolved by adding nulling 
capability to the servo loop to balance the various differential pressure signals. 

Another problem associated with the differential pressure monitoring system 
was the inability to detect some of the open failures. Unless the ram was stationary, 
it was difficult to develop the differential pressure necessary to disengage the 
faulty servo channel. As a result, a latent channel failure could occur in flight in 
the backup control system and not be indicated to the pilot . However , no such fail- 
ures occurred during the program . 

Six discrepancies were attributed to system wiring and aircraft power distri- 
bution. Four involved, respectively, a pin that was pushed back in a connector, 
a short-circuited cable clamp, a defective latching relay, and a faulty battery capac- 
ity meter . The faulty items were identified and repaired during the regular air- 
plane preflight. Two flights were aborted because of aircraft power problems. One 
was due to a checklist error that allowed the flight control system generator to re- 
main off, causing a low -voltage shutdown of the computer, and the other was due to 
a main generator failure. All those discrepancies were considered to be typical air- 
plane operating problems and not unique to fly-by-wire control systems . 

Four discrepancies that affected or would have affected the digital fly-by-wire 
system occurred in the aircraft hydraulics systems , and all required repair action . 
Hydraulic leaks that caused two flights to be cancelled were detected in the second- 
ary actuators. During one flight, hydraulic oil was seen streaming along the out- 
side of the airplane, and as a precautionary measure the flight was terminated and 
the airplane returned for a normal landing. During another flight, a hydraulic line 
ruptured, causing a loss of hydraulic pressure to backup channels 2 and 4. The 
hydraulic line was part of the basic F-8C hydraulic system that was not modified for 
the program. The loss of hydraulic pressure was detected by the pilot from the 
conventional F-8C hydraulic pressure gages and warning lights. The pilot terminated 
the flight and landed the airplane with the primary control system. Hydraulic line 
failures are rare but serious for flight control systems that depend on irreversible 
hydraulic actuators, such as those being used in all high-performance fighter and 
bomber aircraft and many new transport aircraft . Protection against hydraulic 
system failure is provided by using dual or triple hydraulic systems . Experience 
with aircraft that use irreversible actuators has shown the protection provided by 
this practice to be adequate. 

As the table shows , similar operating problems were experienced with the iron 
bird control system. All the simulation systems were flight qualified and could be 
flown on the airplane except the mechanizations of the primary and backup elec- 
tronics, which were not maintained with flight system quality control. The experi- 
ence obtained during the almost 2500 hours of operating time on the iron bird and 
the F-8 digital fly-by-wire airplane is indicative of what could be expected of a 
similar period on the aircraft system . 

Although many component discrepancies occurred during the program , they 
were detected by the monitoring system and testing procedures, and the reliability 
of the total system was maintained throughout the program . 
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CONCLUDING REMARKS 


A digital fly-by-wire control system with a triplex analog backup control sys- 
tem was flight tested in an F-8C airplane. Six pilots logged 58 flight hours during 
42 flights . The backup control system operated well in conjunction with the digital 
primary system and provided satisfactory handling qualities throughout the flight 
envelope evaluated . This experience showed that a dissimilar control system can 
be made to synchronize with the primary flight control system and provide satis- 
factory control during normal flight maneuvers. 

A limited flight test program was flown to evaluate airplane handling qualities 
with a force side stick controller through the backup control system. Even though 
side stick force gradients were not optimized , the control of the airplane in a variety 
of control tasks, including takeoff, landing, and formation flight, was satisfactory. 

The operational reliability of the digital fly-by -wire system , both primary and 
backup, was excellent. There were no downmodes from the digital primary con- 
trol system to the backup control system in flight due to real or apparent system 
failures. Several component discrepancies occurred within the redundant system, 
but they did hot affect the reliability of the total system . Most of the discrepancies 
were in the secondary actuator differential pressure network and were nuisance 
tripouts (capable of being reset) within the backup control system during large 
control inputs to the digital primary control system . 
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TABLE 1.- F-8 DIGITAL FLY-BY-WIRE CONTROL SYSTEM DISCREPANCIES 
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Flight terminated. 

System redundancy reduced to two channels on 
one flight . 




Figure 1 . F-8 digital fly -by -wire control system . 
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Figure 7 . Typical primary control system channel . 
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Figure 9. Hydraulics of secondary actuator with primary channel 
in control and channels 2, 3, and 4 in standby configuration. 
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S UMMARY 


Present practices in lightning protection of aircraft 
deal primarily with the DIRECT EFFECTS of lightning, such as 
structural damage and ignition of fuel vapors. There is 
increasing evidence of troublesome electromagnetic effects, 
however, in aircraft employing solid-state microelectronics in 
critical navigation, instrumentation and control functions. 

The potential impact of these INDIRECT EFFECTS on critical 
systems such as Digital Fly-by-Wire ( DFBW) flight controls has 
been studied by several recent research programs, including an 
experimental study of lightning-induced voltages in the NASA 
F 8 DFBW airplane. The results indicate a need for positive 
steps to be taken during the design of future fly-by-wire sys- 
tems to minimize the possibility of hazardous effects from 
lightning . 


INTRODUCTION 


Present practices in lightning protection of aircraft 
deal predominantly with 'what may be called the DIRECT EFFECTS 
of lightning, including burning, blasting and physical defor- 
mation of skins and structural elements. Existing lightning 
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protection specifications, such as MIL-B-5087B, (Bonding, 
Electrical, and Lightning Protection, for Aerospace Systems) 
concentrate on electrical bonding and its function in mini- 
mizing these effects. Other criteria such as FAA Advisory 
Circular No, AC 25-3A, provide guidance for protection against 
lightning ignition of flammable fuel-air mixtures. Concern 
with these effects has been necessary since safety of flight 
in a lightning environment has heretofore primarily depended 
upon protection against fuel ignition and structural damage 
that can be produced by lightning. There is increasing evi- 
dence of troublesome electromagnetic effects due to lightning, 
however, as a result of transient surge voltages induced in 
aircraft electrical wiring. These voltages have caused both 
permanent damage and temporary malfunction of equipment. 

Earlier vacuum tube electronics were inherently less 
vulnerable to lightning-induced voltage surges; however, the 
newer generations of modern, solid state microcircuitry are 
increasingly more vulnerable to upset or damage from such 
effects. Because these are e lec tromagne tically induced ef- 
fects, they are often referred to as the INDIRECT EFFECTS of 
lightning. Recently, these effects have been receiving addi- 
tional attention since the flight safety of modern aircraft is 
increasingly dependent on reliable operation of critical 
electronic systems. At present there are no standards or 
specifications applicable to the INDIRECT EFFECTS of lightning. 

With the advent of fly-by-wire systems, particularly 
those with digital computer and control electronics, the in- 
direct effects of lightning very clearly have the potential of 
presenting a hazard to safety of flight. This hazard may be 
particularly acute for digital systems. While most practical 
digital fly-by-wire systems would include multiple redundant 
control circuits it is possible to conceive of a situation in 
which the high level electromagnetic interference produced by 
lightning could interfere with all channels of a fly-by-wire 
system at once, raising the possibility that there may in fact 
be no real redundance with respect to lightning effects. 

The NASA Flight Research Center has developed and is 
presently demonstrating a digital fly-by-wire (DFBW ) flight 
control system in an F8 aircraft. Recognizing the possibility 
of this hazard, a program was implemented with General Electric 
to evaluate the possible electromagnetic effects of lightning 
on this flight control system and obtain data for use in mini- 
mizing these effects in future generations of fly-by-wire air- 
craft. The F 8 DFBW system was not designed to withstand light- 
ning strike effects. Therefore , the opportunity existed to 
experimentally determine the severity of effects in this unpro- 
tected system, thus providing test data upon which to base 
design guidelines for protection of future systems . 
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SYMBOLS 


A/C Aircraft 

AGC Apollo Guidance Computer (DFCS computer) 

BCS Backup Control System 

DFCS Digital Flight Control System 

DFBW Digital Fly by Wire 

IR Structural ohmic resistive voltages 

i Lightning current 

L 


TEST AND MEASUREMENT TECHNIQUE 


A recently developed simulated lightning test and measure- 
ment system known as the TRANSIENT ANALYSIS technique offers a 
means of investigating the electromagnetic effects of light- 
ning without hazard to the aircraft being tested. This tech- 
nique, the development of which was sponsored by the Aerospace 
Safety Research and Data Institute of NASA-Lewis Research 
Center (Ref. 1), consists of injecting current surges into an 
aircraft, of the same waveshape as those produced by lightning 
but of greatly reduced amplitude. The responses of the air- 
craft's electrical circuits to these current surges can be 
measured and then extrapolated to correspond with full light- 
ning stroke amplitudes to determine if they present a hazard to 
the equipment under test . During the development of this 
technique, tests were made to show that the response of an 
aircraft electrical system was linear with lightning current 
amplitude and that this extrapolation was valid. The transient 
analysis technique was utilized in the study of the NASA F8 
DFBW aircraft in this program. A photograph of the aircraft 
and test setup is shown in Figure 1. 

The test circuit is shown on Figure 2(a). The airframe is 
connected to ground at the point nearest the terminals of the 
circuit being measured via a 36 inch wide, 3 mil aluminum foil. 
This was attached to the instrument table and the hangar ground 
about 20 feet away. Use of the aluminum foil provides a very 
low impedance between the airframe and instrument table. The 
instrument cable was placed along this foil so that no air gap 
existed between it and 'the foil. As shown on Figure 2(b), the 
lightning current circuit is grounded once and only via this 
airframe ground foil. Consequently, no simulated lightning 
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current could flow off of the airframe along this path or the 
instrument cable shield and get back to the transient analyzer. 

Most of the tests were made with a unidirectional simu- 
lated lightning stroke current rising to its crest in 2.75 
microseconds and decaying to half value after 60 microseconds. 
This waveform is representative of natural lightning stroke 
waveforms and is similar to the waveform specified for indirect 
effects testing of the Space Shuttle. Its crest amplitude was 
set at 300 amperes to minimize the possibility of interference 
or damage to any of the electronic systems or components aboard 
the aircraft. Natural lightning strokes exceed 200,000 amperes 
about 1% of the time and average about 30,000 amperes in ampli- 
tude. Therefore, voltages induced by this waveform must be 
extrapolated upward by a factor of 100 to correspond with an 
average lightning stroke or 670 to correspond with a severe 
200 k.A stroke. The test current waveform is shown on Figure 2a 

It will be noted that damped oscillations appear on the 
test current wavefront. These are believed to be the result 
of traveling wave reflections in the transmission line formed 
by the aircraft and return conductor beneath it. Measurements 
were made of the current entering as well as leaving the air- 
craft, verifying that the superimposed oscillations flowed 
through the aircraft along with the fundamental current wave- 
form. The extent to which oscillations or "jagged edges" occur 
in natural lightning current wavefronts is not well known, 
although available oscillographic data (Ref. 2) does show 
evidence of such occurrences in some strokes. 

Induced voltages were measured by a Tektronix Type 545 
oscilloscope with a Tektronix Type G differential pre-amplifier 
The differential measurement system previously developed for 
this technique and described in Ref. 1 was utilized. One 
channel of the measurement circuit was normally connected to 
the circuit conductor being measured, and the other channel was 
connected to the DFCS ground, airframe ground or circuit low 
side, as required for the measurement being made. The pre- 
amplifier subtracted the signal on the second channel from that 
on the first so that common-mode errors induced in the instru- 
ment cable would not appear in the measurement. 

Measurements were made with the DFBW system powered with 
batteries and operating in the primary mode. Access to most 
circuits was made with break-out boxes at important interfaces 
in order to maintain circuit continuity, although some measure- 
ments were made at opened interfaces to obtain measurements of 
open-circuit voltages at cable ends. 
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DESCRIPTION OF DFBW SYSTEM 


The F 8 digital fly-by-wire flight control system compo- 
nents are shown in Figure 3 . A single digital primary channel 
and triple redundant electrical analog backup channels replaced 
the F 8 mechanical control system. The primary and backup 
channels all provide three-axis control of the airplane. The 
digital channel consists of a lunar guidance computer, inertial 
measurement unit, coupling data unit, and astronaut display 
and keyboard, all taken from the Apollo guidance and navigation 
system. A mode and power panel permits the pilot to request 
the lunar guidance computer to make mode and gain changes. The 
three-channel backup control system consists only of surface 
position command electronics. Specially designed electro- 
hydraulic secondary actuators interface the primary and backup 
electronic commands with the conventional F8 control surface 
power actuators. 

Figure 4 shows the general arrangement of the flight con- 
trol system hardware in the F8 airplane. Five secondary 
actuators were required, one for the rudder and one each for 
the two horizontal stabilizers and the two ailerons. The Apollo 
lunar guidance computer is the heart of the primary control 
system and performs all flight control computations. 

The DFBW system is described in more detail in Reference 3. 

TEST RESULTS 


Measurements were made at a variety of primary and backup 
system interfaces. Of greatest interest were the induced volt- 
ages appearing at the wiring interfaces with the primary DFCS 
system, which includes the Apollo lunar guidance computer (AGO) . 
Figures 5, 6 and 7 show some of the measurements. For all of 

these measurements the simulated lightning current entered the 
nose and exited from the tail of the aircraft. Figure 5 shows 
measurements made at the J25 interface on circuits coming from 
the mode and power control panel and stick, BCS and yaw trim 
transducers in the cockpit area. These appear as damped oscil- 
lations at a fundamental frequency of about 1 megahertz. Most 
of the voltage has subsided after about 6 microseconds has 
elapsed. Each voltage shown on Figure 5' is a damped oscillation 
at a fundamental frequency of about 1 megahertz since all con- 
ductors follow the same bundle to the cockpit. The waveforms 
have slight variations which are probably due to differences in 
load impedances at each' end. 
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Figure 6 shows voltages induced in the pitch, roll and yaw 
control sensor circuits coming to the DFCS computer, but the 
measurements were made at plug P4 with this plug disconnected 
from the DFCS system. These, therefore, are open circuit volt- 
ages and are not necessarily the same as the voltages which 
might appear at the closed interface, since DFCS input impedances 
would affect the voltages impressed across them. The charac- 
teristic frequencies of the open-circuit voltages measured at 
pins D-E (osc. 528), G-H (osc. 525), W-X (osc. 523) and Y-Z 
(osc , 526) have a fundamental frequency of about 1.7 megahertz 
with lower amplitude oscillations of several higher frequencies 
superimposed. These are induced in circuits coming from the 
DFCS stick transducer in the cockpit. The fundamental fre- 
quency of voltages measured at pins A-B (osc. 524) and U-V 
(osc. 527) in circuits coming from the rudder pedal 
transducer in the tail area is also 1.7 megahertz but without 
as much of the superimposed higher frequency component. Neither 
fundamental frequency is the same as that measured at the closed 
J 2 5 interface in circuits also coming from the cockpit area. 

The closed circuit J2 interface measurements shown on 
Figure 7 are of the same 1 megahertz fundamental as those mea- 
sured at the J25 interface of Figure 5, except that the polarity 
is reversed. 


DISCUSSION OF RESULTS 


Induced Voltages 

Study of the induced voltages measured in this system indi- 
cates that they are primarily of aperture magnetic flux origin 
due to the absence of long-duration unidirectional components 
induced by diffusion magnetic flux appearing inside the airframe 
when lightning current has diffused to the inside of its skin. 
Indications of structural IR voltage components are also absent, 
as expected, since the system is single-point grounded and has 
no direct reference to the airframe at locations remote from 
the DFCS pallet where these measurements were made. The single- 
point ground to the airframe is at the DFCS pallet. 

The most prevalent frequency of oscillation of induced 
voltages measured at the DFCS interface is about 1 megahertz. 
This is not the same frequency as the oscillations superimposed 
on the simulated lightning current wavefront, which is 2.6 mega- 
hertz. If fact, there is no similarity between this frequency 
and that of induced yoltages measured anywhere in the DFCS 
system * Fourier transformations were made to determine the 
frequency spectral distribution of the actual lightning test 
waveform as compared with an idealized smooth-front waveform. 
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Spectral peaks above the smooth-front waveform distribution 
occur in the test waveform distribution at 2.5, 5 and 8 mega- 

hertz , but not at the 1 megahertz frequency of the induced 
voltages measured at the DFCS interfaces. 

The induced voltages reach their maximum during the first 
several microseconds of lightning current flow, which is when 
the lightning current and corresponding aperture flux are 
changing most rapidly. Continued oscillations appearing for 
several more microseconds are most likely the result of subse- 
quent traveling waves in the circuit being measured. If this 
is so, the frequency of these voltages is primarily a function 
of the distributed circuit inductance and capacitances. 

The variation in fundamental frequencies and presence of 
more than one frequency component in a single voltage is prob- 
ably due to variations in circuit routing and interconnections 
with other circuits in the system. 

The ranges of voltage amplitudes measured at the DFCS 
interfaces, when scaled to a 200,000 ampere (fast) lightning 
waveform, are presented in Table "I. 

Table I - Range of Induced Voltage Amplitudes 

(Scaled to i T = 200 kA) 

L 

INDUCED VOLTAGE AMPLITUDE 


INTERFACE 

(0 - 

Peak Volts) 


MIN , 

MAX , 

Stick Trim and MPC inputs to DFCS (J25 ) 

233 

900 

Stick Transducer Inputs to DFCS (P4 ) 

40 

87 

DFCS Control Outputs ( J2 ) 

233 

400 

BCS Control Inputs (J12) 

222 

422 

Mode and Power Control ( J15 ) 

833 

1132 

Mode and Power Control (J14) 

213 

732 

Power Dist. Bay (+28VDC BUS) 

160 

200 

DFCS Ground to A/C Ground 

— 

666 


Voltages measured at other locations in the DFBW system, 
such as at the secondary actuators and BCS electronics, were of 
generally similar magnitudes. 
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Impact on DFCS System 


The expected impact of the induced voltages measured in the 
DFCS system on system operation was analyzed by DELCO Electronics^ 
manufacturer of the DFCS. Comparison of individual component 
vulnerability data, when available, with induced voltage levels 
at single circuit interfaces was utilized to determine vulnera- 
bility of system components and effect on circuit operation* In 
other cases, best engineering judgment was used* An example of 
such an assessment is the attitude (yaw, pitch or roll) gain 
logic power circuits (pins A-W) from the MPC panel to the DFCS 
pallet. The schematic diagram of one of these circuits is shown 
on Figure 8* Induced voltages at the J25 interface are shown 
on Figure 5 (i.e. osc . 505). The voltages at the J25 interface 

(DFCS) ranged from 566 to 865 volts, and at the Jl 5 interface 
(MPC), 1065 to 1132 volts* At the MPC, the induced voltage 
exceeds the 1000 volt (at sea level) dielectric breakdown rating 
of the switch. Arc-over may therefore occur either to case and 
mounting or between contacts, with a possibility of switch fail- 
ure . 


This circuit (+28 VDC) provides a request to the computer 
to change attitude control loop gain. If the wiper arm of the 
switch burns open, the computer will notice no gain requests 
and under this condition is programmed to assume attitude gain 
position 1. The DFCS control will survive at this gain position. 
If the switch would short such that two gain-position requests 
exist, the computer is programmed to assume the lower gain of 
the two requests. The DFCS control will survive. 

At the AGC , the induced voltage exceeds the 500 volt dielec- 
tric breakdown rating of the 20K resistor, R2 . Arc-over of R2 
may then expose capacitor Cl to damaging overvoltage, causing 
it to short circuit. If it remains shorted during the entire 
lightning flash, no further damage should occur. If Cl opens 
between successive strokes of a multiple stroke flash, arc- 
over (s ) of the 1.5K resistor R4 on successive strokes may per- 
manently destroy transistor Q1 . If Cl is short circuited, the 
AGC gain change circuit will be inhibited. Selection of this 
gain position after the lightning flash will cause the computer 
to select attitude gain position 1. The DFCS control will sur- 
vive at that gain position. The same applies if transistor Q1 
fails . 

As another example, the DFCS digital control output cir- 
cuits are considered. The schematic diagram of these circuits 
is shown on Figure 9. Induced voltages measured at the J2 
interface are shown on /Figure 7 and range from 233 to 400 volts. 
Those measured at the P1.2 end ranged between 222 and 422 volts. 

At the DFCS, capacitor C2 has a 15V rating. Therefore it would 


80 



break down as a short circuit. The capacitor could then fail as 
an open circuit. In either case the remaining circuit compo- 
nents would probably survive the lightning stroke. These are 
dual circuits which provide attitude commands which are utilized 
as control surface inputs. The dual outputs are compared to 
each other for failure detection purposes. Since capacitor C2 
can be failed as an open or short circuit, several combinations 
were considered. If C2 is shorted as a dual output, no failure 
detection would occur. The pilot would discover that a problem 
existed only by noting the lack of aircraft response to control 
stick position. If one of the dual command outputs contained 
C2 open circuited and the other short circuited, any off-neutral 
control stick position would trigger the failure detection 
circuit which would remove that attitude axis control from DFCS 
to the BCS . In the case of C2 open-c ir cuted as a dual output, 
DFCS aircraft attitude control could be maintained. 

Other individual circuits were assessed in the same manner. 
Failure in some circuits is likely to degrade DFCS performance, 
but in others, the consequences appear minimal. It is evident, 
from Figures 5, 6 and 7, that lightning-induced voltages appear 

simultaneously in all DFCS circuits. 

They also appeared in the 3 BCS channels. Thus, the con- 
sequences of simultaneous failures in many circuits must be 
fully assessed before the total impact on system operation can 
be determined. This has not been accomplished for this system. 

In general, however, it was found that many DFCS components 
are vulnerable to the induced voltages expected from a 200,000- 
ampere lightning stroke. The most vulnerable components are 
capacitors, transistors, and relay arc-suppression diodes. 

The least vulnerable components that may be damaged are switches, 
relays, forward loop diodes, and inductors. 

It should be remembered that the DFCS equipment is an 
adaption of existing Apollo Lunar Module equipment that was not 
designed to survive 1 ightning- induce d voltages, and also, that 
a 200,000 ampere stroke is likely to occur only about 1% of the 
time. The average amplitude is about 30,000 amperes. Under 
this condition, component vulnerability is reduced. 
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CONCLUSIONS 


This program represents the first experimental investi- 
gation of lightning-induced effects on a fly-by-wire system, 
digital or analog. The results of this study are therefore 
significant, both for this particular aircraft and for future 
generations of aircraft and other aerospace vehicles such as 
the Space Shuttle, which will employ digital fly-by-wire flight 
control systems. Particular conclusions from this work are as 
follows : 

1. Equipment bays in a typical metallic airframe are poorly 
shielded and permit substantial voltages to be induced 
in unshielded electrical cabling inside. 

2. Lightning-induced voltages in a typical aircraft cabling 
system pose a serious hazard to modern electronics, and 
positive steps must be taken to minimize the impact of 
these voltages on system operation. 

3. Induced voltages of similar magnitudes will appear 
simultaneously in all channels of a redundant system. 

4. A single-point ground does not eliminate lightning-induced 
voltages. It reduces the amount of diffusion-flux induced 
and structural IR voltage but permits significant aperture- 
flux induced voltages. 

5. Cable shielding, surge suppression, grounding and interface 
modifications offer means of protection, but successful 
design will require a coordinated sharing of responsibility 
among those who design the interconnecting cabling and those 
who design the electronics. A set of Transient Control 
Levels for system cabling and Transient Design Levels for 
electronics, separated by a margin of safety, should be 
established as design criteria. Data from this and other 
experimental programs should be utilized to help establish 
these criteria . 
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FIGURE 1 - TEST SETUP FOR MEASUREMENT OF L IGHTN I NG- IN DUCED 

VOLTAGES IN NASA F8 DFBW AIRPLANE. 
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FIGURE 2 - SIMULATED LIGHTNING 
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5. MAN-RATED FLIGHT SOFTWARE FOR THE F-8 DFBW PROGRAM 


Robert R . Bairnsfather 
The Charles Stark Draper Laboratory, Inc. 

SUMMARY 


The design, implementation, and verification of the flight control soft- 
ware used in the F-8 DFBW program are discussed. Since the DFBW utilizes an 
Apollo computer and hardware, the procedures, controls, and basic management 
techniques employed are based on those developed for the Apollo software sys- 
tem. Program Assembly Control, simulator configuration control, erasable- 
memory load generation, change procedures and anomaly reporting are discussed. 
The primary verification tools — the all-digital simulator, the hybrid simula- 
tor, and the Iron Bird simulator — are described, as well as the program test 
plans and their implementation on the various simulators. Failure-effects 
analysis and the creation of special failure-generating software for testing 
purposes are described. The quality of the end product is evidenced by the F-8 
DFBW flight test program in which 42 flights, totaling 58 hours of flight time, 
were successfully made without any DFCS inflight software, or hardware, fail- 
ures or surprises. 


INTRODUCTION 


From early 1971, CSDL participated in Phase 1 of the Digital Fly-by-Wire 
program being administered by NASA Flight Research Center (NASA/FRC) . Overall 
program effort was directed toward a series of demonstration Fly-by-Wire (FBW) 
aircraft flights. A triply redundant Analog Fly-by-Wire (AFBW) Backup Control 
System (BCS), employing a simple open-loop control algorithm, is coupled with 
the primary flight control system to provide the two-fail-operate/f ail-safe 
reliability necessary for severing mechanical linkages. The simplex Digital 
Fly-by-Wire (DFBW) Primary Control System (PCS) has both software and hardware 
failure-detection capability in the digital computer. There are also indepen- 
dent monitoring and failure-detection modules operating on PCS control com- 
mands, power supplies, pilot input devices, and other critical areas. Finally, 
there is the capability for pilot-initiated downmoding to BCS via several inde- 
pendent paths. There are seven selectable PCS flight control modes available. 
Three Direct (DIR) modes consist of pilot stick/pedal plus trim applied directly 
to the control surfaces. Three Stability Augmented System (SAS) modes incor- 
porate body-axis angular rates (and lateral acceleration) as feedback variables. 
The Command Augmented System (CAS) mode is basically pitch SAS with normal 
acceleration feedback and forward- loop integral bypass. The only BCS mode. 
Direct, is also selectable by axis. 
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The first Fly-by-Wire flight was made on 25 May 1972 ^ in the high per- 
formance F-8C fighter assigned to the DFBW program* Takeoff and landing were 
made in PCS/DIR. Basic performance and handling qualities were demonstrated 
at several flight conditions, both in BCS and PCS/DIR* Closed-loop PCS/SAS was 
first flown on 18 August 1972 with subsequent flights building toward full sys- 
tem capability* The demonstration flight test program continued through late 
1973* 


The CSDL role in the F-8 DFBW program has been directed at the PCS soft- 
ware 9 hardware, and peripherals* Specific tasks have beeni the hardware de- 
sign, development, and testing of the uplink and downlink converters, the P IP A 
Simulator, and the Gimbal Angle Simulator; and software design, implementation, 
and verification of the NASA/FRC three-axis Primary Control System algorithms; 
the functional design, software design, production, and verification of the 
mode and gain change routines, miscellaneous ground test programs, and open- 
loop inflight earth-rate torquing routine; the interface design including 
failure analysis; simulation support; the review and verification of preflight 
erasable loads. 


The F-8 DFBW System 

Aircraft- — The F-8C Crusader, a carrier-based U.S.Navy fighter of mid-50’ s 
vintage, is a high-performance single-seat aircraft capable of Mach 1.8 flight 
at altitudes of 60,000 feet. NASA/FRC obtained several surplus aircraft of the 
F-8 series. Two of them are involved in the F-8 DFBW program, one as the flight 
article and one as the Iron Bird Simulator test article. Figure 1 depicts the 
F-8C aircraft, showing the physical distribution of key F-8 DFBW hardware. De- 
scriptions of the hardware are given in Table 1 and Table 2. 

Digital System — The digital computer used by the PCS is the general pur- 
pose Apollo/LM Guidance Computer (LGC) . An Apollo Inertial Measurement Unit 
(IMU) provides attitude angles, angular rates, and linear accelerations for 
feedback control. Major considerations for using the Apollo hardware were that 
it possessed a demonstrated reliability and flexibility. Moreover, surplus LM 
hardware was available from cancelled Apollo missions. Experienced teams of 
software and hardware specialists were also available, for software and systems 
integration tasks, at CSDL and Delco Electronics. A functioning Operating Sys- 
tem software existed for the LGC, in addition to the supporting facilities of 
the powerful Assembler software, the All-Digital Simulator, and two hardware- 
integrated simulators at CSDL. Starting with this framework meant that a signi- 
ficant portion of the development task was already completed. There were some 
disadvantages, the most significant being the July 1972 scheduled shutdown of 
the core-rope manufacturing facilities for the LGC fixed memory. Another dis- 
advantage, although not recognized immediately, was that the F-8C performance 
envelope exceeded the design capabilities of some Apollo hardware items. This 
influenced the digital flight control system (DFCS) performance, and required 
a reduced performance envelope, which, while less than F-3C capabilities, was 
nevertheless acceptable for an experimental digital fly-by-wire testbed. 
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Computer— The LGC contains two distinct memories , fixed and erasable, as 
well as hardware logic circuits . The fixed memory is stored in a wire braid 
which is manufactured and installed in the computer* This memory cannot be 
changed after manufacture and it can only be read by the computer* Fixed memory 
contains 36,864 words of memory grouped into 36 banks* Each word contains 15 
bits of information, plus a parity bit* The erasable memory makes use of fer- 
rite cores which can be both read and changed* It consists of 2048 words 
divided into 8 banks. Erasable memory is used to store such data as may change 
up to or during a mission, and is also used for temporary storage by the pro- 
grams operating in the computer* The memory cycle time (MCT) in the LGC is 
11*7 ys. Host single-precision instructions are completed in two MCTs; most 
double-precision machine instructions are completed in three MCTs. 


SOFTWARE DEVELOPMENT 


The software control procedures employed for F-8 DFBW selectively follow 
those developed and successfully applied during the generation of software pro- 
gram assemblies for the Apollo command and lunar module computers. A continua- 
tion of useful procedures, made necessary because the F-8C uses the same Apollo 
hardware, and desirable because of schedule limitations, was easily imposed by 
the CSDL personnel connected with F-8, all of whom were contributors to the 
Apollo effort. The limited scope of F-8 dictated some changes in procedure, but 
these were basically simplifications commensurate with the level of effort. 
After all, approximately 400 man-months /month were expended in Apollo by CSDL 
programming and engineering groups just prior to the first lunar landing, while 
F-8 DFBW peaked at about 9 man-months /month. The critical time span was from 
Control Law Specification delivery in March of 1971 until program release for 
fixed-memory core-rope manufacture in mid-December of 1971. Since that date, 
CSDL has supported Preflight Erasable Load generation, failure analysis, pre- 
flight procedure preparation, and Erasable Memory Program development and 
verification. The timely development and excellent flight-test performance of 
DFBW software attest to the effectiveness of the control procedures employed. 

It is worth emphasizing that we now have more modern software techniques, but 
that Phase 1 of F-8 DFBW was a basic evaluation program, and utilized off-the- 
shelf software as well as hardware. Approximately 85 man-months and 95 hours 
of IBM 360/74 computer time were required for the Phase 1 software design, 
implementation, and verification tasks. The F-8 chronology is shown in Fig. 2. 


Operational Software 

The operational software for F-8 DFBW consists of two basic categories: 
the DFCS Program Assembly, and the Preflight Erasable Load Assembly. In the 
finished product, the DFCS Program Assembly is embodied in the core rope and 
comprises the computer f s fixed memory. At this stage, it has become hardware 
and is effectively a breadboard autopilot in that the structure is invariant 
while most parameter values and switch words are variable. For F-8 DFBW, there 
is only one final Program Assembly, from which the flight rope and an identical 
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spare are manufactured* The Preflight Erasable Load Assembly is embodied in a 
tape and comprises the computer’s Initial Data Load* The tape, KSTART, con- 
tains parameter values and switch settings required by the program., and the 
computer receives it as a part of each power-up sequence* A new Preflight 
Erasable Load Assembly is made whenever a flight test requires new parameter 
values* To ensure the high degree of reliability and safety that is necessary 
for man-rated flight software, both assembly processes are carefully controlled* 


Program Assembly 

The Program Assembly has two main functional areas: Systems and Appli- 

cations* Grouped under Systems are Executive, Restart, and Service* Applica- 
tions covers Flight Control, and Miscellaneous, The Executive code includes 
the priority job-queue processor, the time task-queue processor, the time- 
dependent interrupt processor, the idle-job routine. The Restart code includes 
the hardware restart interrupt processor, computer initialization routine, the 
program alarm processor, the restart-group phase-control routines. The Ser- 
vice code includes the list-processing interpreter, the IMU monitor, the com- 
puter self- test routines, the man-machine interface routines, the interrupt 
processors. The Flight Control code includes the autopilot initialization 
routine, the mainline processor, the filter pushdown and wrap-up processor, 
the input discrete processor, the Mode and Gain change processor, the body 
transformation matrix processor. The miscellaneous code includes the ground 
test programs, and special-purpose applications routines* 

In several areas, the flight control requirements and the LGC character- 
istics posed interesting problems. Some of these are singled out. 

Duty Cyle— Early in the development process it became clear that the 
Flight Control system would create a relatively high duty cycle in the LGC due 
to several causes: LGC instruction time (24 ys/instr), the flight control 

sample period (30 ms) and the generalized nature of the control system. Since 
the entire LGC is devoted to the DFCS, words of code could be traded for in- 
creased time efficiency wherever possible; that is, code is designed for 
minimum execution time rather than for minimum storage* Time savings are also 
realized for control parameters, where combinable multiple parameters are re- 
placed by an equivalent single parameter in a working register, whose value is 
generated only once by program initialization* 

Restart Protection — A hardware restart is a special interrupt that takes 
precedence over all other interrupts, and that cannot be inhibited* The hard- 
ware restart is triggered by circuitry in event of selected computer malfunc- 
tions. On completion of the restart, all output channel discretes are cleared, 
and computer control is transferred to a specific memory location, i.e,, to 
the Restart Routine. The Restart software rapidly reestablishes the channel 
output interfaces because F-8C control surface commands and the PCS primary- 
enable signals depend on a viable interface. The restart software next restores 
the program flow by reestablishing the job-queue and time-queue, and by causing 
the program whose execution was interrupted to resume at the latest restart 
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point. Restart points are entry points , breaking program flow into separate 
blocks , such that a properly restart-protected program will reproduce the 
same values after a restart as before. 

In general , a repetition of code execution is involved following a re- 
start because the nature of the LGC requires software recovery procedures. 
However , the repetition requires that special care be taken during code gen- 
eration to avoid creating situations where a restart will cause a multiple 
update of a variable. For example, if the operation A+B + A occurs between 
two restart points, then A is updated at each pass through the code. This 
violates the rule that the values generated by code repetition after a restart 
must be the same as before. The situation of multiple updates is avoided by 
a copy cycle, which involves an intermediate variable and an additional restart 
point. For the example we have A+B -* C, followed by the new restart point, 
followed by C A. Clearly, the final value of cell A is unaffected by code 
repetition. Copy cycles are common in Apollo code and have the advantage of 
economy of erasable memory usage although they are expensive in terms of exe- 
cution time. Note that cell C is intermediate and can be used by many copy 
cycles . 

Rather than use copy cycles, F-8 DFBW prefers a method that, because of 
the high DFCS duty cycle, is conservative of time but is expensive in fixed 
and erasable memory cells, doubling the number. Two functionally identical 
strings of code, a J -branch and a K-branch, are required with processing alter- 
nating from one to the other. Two equivalent sets of erasables are required, 
also J-branch and K-branch. The J-branch code uses K-branch (past value) 
outputs plus J-branch (present value) inputs to compute J-branch (present 
value) outputs. No special copy cycles are required, and computations are 
efficiently performed. Copy cycles would likely have pushed DFCS duty cycle 
dangerously close to 100%. It reaches 91% even with time-efficient restart 
protection. 

Indirect Transfer — At sixteen critical points in F-8 DFBW program flow, 
and at one point in the downlink program, a capability is provided for erasable 
indirect transfer of control. In application the program flow of the hardware 
core-rope fixed memory program is determined by the address contained in a 
specific erasable cell at the time the cell is accessed by the program. 

Erasable cells used in this manner fall into two classes. There is the class 
of cells whose contents (the destination address) is changed regularly under 
program control, say every 20 ms or 30 ms. These cells, although erasable, 
form an integral part of the core-rope. The second class consists of cells 
whose contents are in general established only once, either by an initializa- 
tion pass or by the Initial Data Load (KSTART tape). It is this second class 
of erasable cells that provides the powerful capability of altering the program 
flow after core-rope manufacture by means of Erasable Memory Programs. 

Generalized Filters' — Inasmuch as F-8 DFBW is a flying breadboard, the 
feedback sensor quantities are each provided with a generalized filter. The 
five filters, three for body rates and two for linear accelerations, allow 
flexibility of filter choice: bypass, first order, second order, and third 

order. An alternate third order is obtained by cascading the first and second 
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order sections to obtain control over individual poles and zeros. The filter 
coefficients are parameters in the KSTART tape* The filters are active at all 
times , even in BCS/DIR, 

The computations are divided into two phases , the main phase which in- 
corporates the current input with past values to update the output , and the 
pushdown or wrap-up phase which updates the other filter quantities in prepara- 
tion for the next cycle. In this manner the control surface commands which 
use the filter outputs are generated with the shortest delay. The time- 
consuming filter wrap-up calculations are not performed until after closing 
the aircraft control loop* and so do not contribute to the delay. The saving 
is significant because the wrap-up can represent as much as 92% of the total 
filter load. 

Gain Change — Manual gain changing is provided in lieu of automatic gain 
changing as a function of* say, dynamic pressure. Separate pitch, roll, and 
yaw gain-select switches on the MAPP, each with four positions, comprise the 
pilot interface. Selection of a specific gain (or coefficient) parameter is 
made from a fixed list of 105 candidates, serially numbered from 1 to 105, 

Each gain is associated (by axis) with a particular gain-select switch, and 
a maximum of 9 gains can be designated for a given flight. Each gain chosen, 
with its serial number and four values, becomes part of the PEL. When a gain- 
select switch is changed by the pilot, the program recognizes the change and 
the PEL-designated gains associated with that switch axis are changed. For 
each gain in turn, a small routine implements the change, performing all 
necessary scaling, recomputing all working registers using that gain, and 
initializing any filter using that gain. 

Erasable Memory Programming- — Erasable memory programming provides the 
only means of modifying the program once the core rope is manufactured. Modi- 
fication can sometimes be accomplished by breaking into the program flow at a 
suitable erasable branch point, which must be of the second class as defined 
above. The procedure is to change the erasable cell contents to point to an 
unused block of erasable memory and to load executable code into that area 
(called an Erasable Memory Program or EMP) , The final instruction of the EMP 
returns control to the fixed memory program. The EMP allows some unanticipated 
problems to be solved by shoehorning suitable code into the program flow. 

Erasable Downlist- — In Apollo, the identification and specification of 
telemetered data was done by means of address tables built into the core rope. 
For a mature design such as Apollo, quantities of interest are well known, and 
properly can be built into the rope. F-8 DFBW, on the other hand, must offer 
flexibility for experimental design. Variables and quantities of interest can 
change from day to day depending on a given flight plan. To accomplish this 
end, erasable specification of the downlist quantities by means of KSTART tape 
is incorporated into the Downlink program. 


98 



Preflight Erasable Load Assembly 

Flexibility is achieved in the F-8 DFBW despite the hardware status of the 
core-rope program by providing for a large number of erasable parameters. The 
aggregate* called the Preflight Erasable Load, consists of three categories: 

Data words, Downlist Words, and Erasable Memory Program words. The Data words 
are constants and include loop gains, filter coefficients, nonlinearity para- 
meters, IMU compensation parameters, branch control parameters, and branch 
control address constants. The Downlist words are address constants that de- 
fine the quantities to be telemetered. The EMP words are executable code and 
associated constants. 

Early in the program the Preflight Erasable Load and the KSTART tape con- 
sisted only of Data words and Downlist words, and were generated by CSDL. But 
the responsibility for the data values resided with FRC, so generation of the 
Preflight Erasable Load and KSTART shifted to FRC as the software capability 
was developed there. However, Erasable Memory Program development was a CSDL 
function, and the verified and accepted EMP code was incorporated into the 
KSTART by FRC. 

Several unique or extremely helpful features characterize the F-8 Pre- 
flight Erasable Load (PEL), and the generation of its KSTART uplink tape, 
specifically: 

(1) PEL parameters are expressed in conveniently scaled, physically 
significant engineering units. 

(2) A DFCS initialization routine translates each PEL parameter (units 
and scaling) into DFCS operational parameters. Factored or ratioed 
parameters are combined into single operational parameters at this 
time. 

(3) Comprehensive error checking and diagnostic indicators are built 
into the KSTART tape generating programs. 

Parameters- — The basic DFCS parameters are expressed in conveniently 
scaled engineering units and constitute the erasable load. The DFCS working 
registers (gains, limit levels, coefficients) are defined so as to minimize 
computation time where possible. This usually results in unusual scaling, 
e.g., number of DFCS samples instead of seconds, or DAC bits instead of sur- 
face degrees. Other working registers are functions of basic parameters, 
such as a simple product, or a limit level that is computed from intercept/ 
slope/breakpoint values. Also a working register might contain an address 
constant, selected from a table in accordance with certain rules. To accom- 
plish the interface between working registers and erasable load parameters, 

F-8 DFBW utilizes an initialization routine. By having an initialization rou- 
tine available to translate the working registers, the engineer preparing 
KSTART tapes, or changing parameters manually via the DSKY during a simulation, 
can continue to think in basic engineering terms. This is especially important 
in F-8 DFBW, since much of the development is performed on hybrid simulators 
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where the DSKY interface is the only practical interface for changing DFCS 
parameters. By keeping PEL specifications simple and by formulating them in 
engineering terms for both physical feel and visibility, the possibility for 
error is greatly reduced. Since programmed and verified initialization soft- 
ware is involved, reliable and complete changes are made quickly by single- 
parameter data entries even though that parameter exhibits multiple usage. 

KSTART Generation- — Two off-line diagnostic programs, DOWNDIAG and 
SHERLOCK, developed by NASA/FRC, contribute significantly to the generation 
of a highly reliable PEL and its KSTART tape. Operational use of these pro- 
grams is shown schematically in Fig. 3. 

DOWNDIAG checks the erasable downlink list specification against format, 
opcode, address, and keypunch errors. It punches the Erasable Downlist (EDL) 
and Downlink Processor (DLP) decks only after error-free input is provided. 

The DLP deck is used for post-flight or post-simulation downlink processing. 

The EDL deck is integrated with the DFCS parameter deck for input to SHERLOCK. 

SHERLOCK likewise checks against keystroke, octal, and address errors, 
but more significantly performs comprehensive reasonability checks, e.g., 
minimum/maximum range or compatibility between related elements. SHERLOCK 
also extracts filter polynomial roots, checks the stability of poles, and 
checks zeroes against minimum/maximum ranges. Diagnostic printouts must be 
answered by corrections to the SHERLOCK inputs, or by signed waivers, before 
output decks are punched, one for the F-8 All-Digital Simulator at CSpL, and 
the other for input to KPUNCH, the KSTART tape diagnostic and punch program. 

KPUNCH calculates the initialization values for the uplink summation 
(UPSUM) registers such that with a proper uplinking of the KSTART tape, the 
UPSUM registers equal 77777 77777 when displayed on the DSKY. Errors generated 
during uplinking will leave numbers other than 7s. KPUNCH also performs 
limited diagnostic checking and ultimately punches the KSTART tape, ready for 
uplinking to the LGC prior to flight. 


F-8 DFBW Software Package 

The F-8 DFBW software package can be broken down as in Table 3 (Fixed 
Memory Allocation) , and Table 4 (Erasable Memory Allocation) . The DFCS code 
is by far the largest single item. Extensive fixed memory is used by Display 
Interfaces (DSKY processing). Interpreter /Executive, and IMU Alignment. Most 
of this code was transferred directly or with minor change from the LM program 
for Apollo 14. The Self-Test Self-Check code came from Apollo preflight 
erasable code. Roughly half (696) of the erasables used are DFCS related, and 
a significant number (389) belong to the Preflight Erasable Load. 


SOFTWARE PROGRAM CONTROL 


The flight software for F-8 DFBW program leans heavily on the experience 
developed for Apollo. The main difference between Apollo software and other 
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(previous) software is that the Apollo software had to work perfectly the first 
time it was used in its real environment, Apollo manned missions had a one- 
shot nature that required guaranteed performance. To achieve such reliability, 
management and supervision controls were set up, and have evolved over several 
years into a system to monitor and check software progress very closely and yet 
not to create an environment that is oppressive to the creativity, persever- 
ance, and dedication of engineers. The system thus created has been proven in 
both developmental and incremental phases of software. Man-rated flight soft- 
ware depends on reliability and confidence built up by careful management and 
supervision controls supported by thorough software verification using real 
hardware and high-fidelity models in simulation. 


Software Management 

A successfully managed software effort must provides 

(1) Realistic estimates of requirements including manpower, assembly 
and simulation budgets, memory allocations, 

(2) Efficiency in the development and verification process including 
non-overlapping testing, effective use of man and machine re- 
sources, 

(3) Achievement of milestones on schedule, 

(4) Visibility of the product including developmental status, trouble 
spots, user-oriented operations and interfaces. 

(5) Flexible and efficient response to design change requests . 

(6) Systematic verification procedures at all module interface levels 
of testing and performance. 

(7) Reliability of final products. 

(8) Quality performance of final products. 

The software management and control system developed for Apollo provided 
such capability. Its selection for F-8 DFBW was a natural outgrowth of success- 
ful prior experience with it. Changes were made, but only when the differing 
situations indicated a modified approach. 

The management and control of flight software is directed toward the 
timely preparation of two end items: a software program assembly from which 

the read-only core-rope memory is manufactured, and a software preflight eras- 
able-load assembly from which a KSTART tape is manufactured to initialize the 
erasable read-write memory. Operational efficiency, performance capability, 
operational flexibility, and overall reliability are demanded of both the fixed 
and the erasable -memory assemblies, since they complement each other in terms 
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of overall performance* Timely availability is likewise a requirement in terms 
of schedule milestones * Changes and additions to the baseline design must be 
implemented with the same quality and timely control* 


Organization and Controls 

The software organization used by F~8 DFBW is relatively simple* The 
Project Manager is the customer Vs contact point* The Project Manager inter- 
faces with the Software Manager, who interfaces with the engineers doing the 
software design, coding, and verification* Both of the latter interface with 
Assembly Control, which is responsible for the assembly process* The types of 
control machinery available to the Project Manager and the Software Manager are 
as follows* 

(1) Software Specification Document is the product specification to 
which the software must conform. 

(2) PCR— a Program Change Request, that officially changes the Software 
Specification (must be signed off by customer. Project Manager, 
and Software Manager). 

(3) PCN — a Program Change Notice, similar to a PCR but deemed impera- 
tive by CSDL (must be signed off by Project Manager and Software 
Manager) . 

(4) Anomaly — a request to fix an error in the program (must be signed 
off by Project Manager and Software Manager). 

(5) ACB— an Assembly Control Board request, identifies a necessary 
program change that is not a specification change (must be signed 
off by Software Manager). 

Under Configuration Control, all coding changes and additions must be covered 
by one of the above forms of approval before the Assembly Control Supervisor 
will incorporate the code into the assembly. 


Assembly Control 

The Assembly Control functions in Apollo were highly structured and very 
formal for the mainline program assemblies. There was an Applications Program- 
ming Development and Testing Group for the two major assemblies. A System 
Integration Programming Group served for all assemblies, but the major assem- 
blies had separate Assembly Control Supervisors. Finally, the Assembly Control 
Service Group served all needs. 

The software generation process is illustratively simplified in Fig. 4. 

A coding task is routed to the appropriate programming group for code design. 
Discussions with the other groups might follow. Completed code is submitted to 
Assembly Control where it is either accepted for the next revision or returned 
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for corrections* At appropriate times , the assembly update deck is submitted 
to make the new revision* The Assembler output is examined by Assembly Control 
and errors are either fixed or referred back to the coder for rectification* 
Notification of a good assembly is given to coder/testers who submit simulation 
test runs* If tests do not work correctly, corrected code is submitted for the 
next revision. On receipt of good results, a new coding task is begun. 

In F~8 DFBW S with a total programming team of about nine people, such 
structuring was not practical or necessary* Nevertheless the spirit of the 
Assembly Control process was maintained* One member of the DFBW team was desig- 
nated Assembly Control Supervisor, but his activities spanned all four of the 
structured areas as time permitted and activity made necessary* For example, 
he monitored, coordinated and submitted all assembly changes, maintained the 
Simulator test packages, published the assembly documentation, maintained and 
verified ICC System software, coded and verified some Applications code, and 
participated in Level 4/Level 5 testing. The other team members likewise found 
their activities spanning the four groups as specific needs came and went, each 
contributing in areas of greatest interest and ability. 


Controllable Items 

In addition to the main program assembly, there are also other areas 
where control procedures must apply. These are the Preflight Erasable Load 
Assembly, Simulator Test Packages, Off-line Program Assemblies, and Erasable 
Memory Programs. 

A Preflight Erasable Load Assembly is associated with each mainline pro- 
gram revision, and consists of data constants, branch-control constants, and 
address constants that are defined in the mainline revision. The Preflight 
Erasable Load Assembly is used to generate data and address decks for Simulator 
test runs and it is essential that these decks be error free. 

The Simulator Test Package supports the software testing and verification 
by providing a common library of test case decks. Functionally the decks cover 
three categories: program initialization, simulation control, and edit control. 

Operationally the decks are invoked in suitable configurations at run time by 
single cards in the user's test deck. 

Off-line Assemblies- — As the mainline program matures, off-line versions 
are useful to check out code prior to updating the mainline assembly. Once the 
design and coding is checked out, a simple transfer of appropriate code is made 
to the mainline assembly. In F**8 DFBW two examples occurred; one was to check 
out a major design modification in the BCS downmode logic just prior to Con- 
figuration Control, and the other was to create a testing and training tool 
capable of failing input/output discretes via DSKY commands. 

Erasable Memory Programs — Erasable-memory programming is a tool enabling 
a limited flexibility for modifying core-rope program flow. A block of code is 
designed to reside in and operate from erasable memory, and a way is devised to 
access the code from the existing rope. 
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Assembly Control Tools 


Assembler — -Since the software was not written in a Higher Order Lan- 
guage 5 a sophisticated assembler was of utmost importance. The Assembler is 
by far the most powerful tool in the Assembly Control process. The lengthy 
evolutionary period of Apollo has generated many fine features. 

Diagnostic Package— The Assembler diagnoses faulty coding in both basic 
and interpretive languages. It issues diagnostic messages about refer- 
ences to non-existent variables, multiple definitions, illegal sequences 
of instructions, improper erasable-bank or fixed-bank references, and 
many others. 

Basic and Interpretive Language— — -The Assembler recognizes two languages; 
basic language, and a list-processing interpretive language. The latter 
permits vector and matrix as well as double and triple precision opera- 
tions; these are processed by the Interpreter software routines in the 
LGC. The Assembler recognizes data constants, noun and verb constants, 
downlink list specification constants, and address constants. 

Flexibility of Memory Allocation — Blocks of fixed-memory programming can 
be referenced to each other so that if a block expands, another block 
need not be moved to make room for it. Overlapping of program memory is 
flagged if it occurs. Overlapping of erasable storage (time-sharing), 
on the other hand, is facilitated by the Assembler. 

Program Visibility* —The Assembler provides complete mnemonic cross- 
reference tables, a summary of erasable memory assignments, and maps of 
both erasable- and fixed-memory storage. All operand references are 
threaded, allowing rapid eyeball debugging even when the relevant pas- 
sages are scattered through hundreds of pages. Word count, including a 
breakdown by functional area, is provided. 

Modularity— The Assembler provides the ability to separately assemble 
and partially diagnose sections of the full program. These can be coded 
separately and brought together into full programs for verification. 

Interface with All-Digital Simulator— The Assembler output includes input 
information for the All-Digital Simulator, which is useful for simulator 
initializations, and for simulator run-time diagnostic error detection. 
The Symbol Table enables the addressing of erasable cells and fixed lo- 
cations by name, rather than by number which tends to vary from revision 
to revision as memory layout is modified. Tapes for fixed-memory loading 
of core-rope simulator can be generated. Constants, bad words (assembler- 
detected errors), unused words, and coding instructions are distinctively 
flagged to permit detection of such run-time errors as ’executing a con- 
stant 1 or ’executing from unused fixed memory 1 . KSTART tapes can be 
punched directly from the Preflight Erasable Load Assembly as a feature 
of the Assembler. 
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Erasable Memory Map 


The limited era sable -memory size of the LGC forced a policy of cell 
sharing as a means of extending memory capability in Apollo; extensive cell 
sharing was necessary , more than doubling the erasable complement and resulting 
in as many as seven distinct usages. An erasable -memory map was used as a 
bookkeeping and planning tool. The map was looked on as a short-lived neces- 
sity 3 otherwise the cell-sharing process would have been automated. In F-8 DFBW, 
even though memory cell sharing is limited , the Erasable Memory Map is an 
especially useful document, A separate map is prepared for each erasable bank 
by the Assembly Control Supervisor, The primary allocation is identified in 
the first column, with the overlays defined in the subsequent columns. The map 
simplifies the problem of assigning multiple use to cells or blocks of cells 
and minimizes the problem of run-time conflicts between LGC programs. The maps 
are extremely valuable to the programmer preparing erasable memory code by 
identifying unused blocks of cells and by aiding in the time-sharing usage of 
cells. 


Software Development Activity 

The software development process, involving all phases of software acti- 
vity, can be summarized in Fig. 5. All software design is based on written 
specification. In Apollo, the specification was the seven volume Guidance Sys- 
tem Operations Plan. In F-8 DFBW, the Control Laws, backup Interface require- 
ments, pilot interface requirements, and data retrieval requirements are 
prescribed in the Software Specification. The LGC executive hierarchy, service 
routines, interrupt processors, restart routines, downlink, and all others that 
came from Apollo are specified by inference as being the same as Apollo. The 
few changes in this category by rights should be documented by PCRs or ACBs. 
However the ultimate documentation in this area, as was similarly true in 
Apollo, is the detailed flowchart* Nevertheless, in the software development, 
authorization must exist in one of the forms: Software Specification, Program 

Change Request, Program Change Notice, or Assembly Control Board direction. 

Another class of input to the Software Development, shown in Fig, 5, is 
the Initial Data Load which becomes the Preflight Erasable Load. The load is 
the cumulative array of values for control law parameters and for other rou- 
tines 1 parameters and, as such, is jointly specified by FRC and CSDL* The load 
is revised and updated to keep pace with the software development. 

A third class of input to the software development is the test plans, 
the most important one being the Level 4 Test Plan. Test plans exist at all 
levels and are the basis for the level testing. At the lower levels, the plans 
are informal tools to ensure thorough unit testing by individual programmers. 
The Level 3 Test Plan and the Level 4/5 Test Plan are carefully documented 
compendiums of specific tests, and cover all areas of the software. The test 
plan is reviewed and updated by all concerned; it can be added to at any time 
to include any overlooked areas. 
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Continuing in Fig. 5, the software is designed in blocks or units with 
each being tested before proceeding to the next. Testing at the unit level 
(Level 1/2) is generally bit-by-bit digital simulation. When a sufficient num- 
ber of units are completed, the hardware and alarm interfaces are tested as 
appropriate. These tests generally involve all three simulators: the Digital, 

Hybrid, and System Test Laboratory. Modular Testing (Level 3) commences in any 
given area when all units in a given program function are completed, for ex- 
ample, the DFCS Direct Mode in the pitch axis. This level of testing continues 
until all DFCS modes and capabilities are completed. Since several program 
areas are developed in parallel, but not all at the same rate, testing at 
several levels takes place during any given time frame. 

When all major programs appear to be essentially completed, Configuration 
Control is instituted, officially designating the start of Level 4, although 
limited Interface testing can take place earlier. Subsequent to Configuration 
Control, all program changes require the careful scrutiny and approval of one 
or more of the software supervisors, as well as the coding experts in the areas 
affected. Software Specification changes require a PCR. Level 4 tests are 
based on the Test Plan, and all incorrect, or unexpected, or incomplete, or 
anomalous behavior is documented in an anomaly report or a discrepancy report. 
Discrepancies are software errors detected after Configuration Control, but 
prior to release-for-manufacture. Anomalies are software errors detected after 
release-for-manufacture. Verification at Level 4 and above involves exercising 
the program on the three CSDL simulators, as well as the FRC Iron Bird System. 
All documented anomalies and discrepancies must be resolved. In some cases 
resolution of a Hybrid or Iron Bird item requires an attempt to reproduce the 
behavior on another simulator, or perhaps the Digital, in order to pinpoint the 
cause. When the cause of a discrepancy or anomaly is identified, an assess- 
ment is made to determine: (1) the operational impact when the problem is 

encountered if the program is left as is, (2) the procedures necessary to avoid 
or to work around the problem, (3) the coding change necessary to eliminate the 
problem, (4) the schedule impact of implementing and verifying the coding 
change. The assessment is documented as a PCR, PCN, or ACB which, if approved, 
is implemented as a fixed-coding change. Erasable coding is not used at this 
level for permanent changes. Disapproved PCRs, PCNs, and ACBs become program 
Notes- Sometimes it turns out that what was thought to be an anomaly, or 
discrepancy, was caused by a simulator bug, or a test deck error; in which case 
the problem is fixed and the test is rerun. 

When all pending program changes are incorporated and tested at Level 4, 
and when no unresolved problems remain, the program is ready for release and 
is declared frozen. A technical review of the Level 4 testing is held (pre- 
FAC I) . If, in any areas the testing appears to need reinforcement, then new 
or additional Level 4 tests are defined. The Level 5 testing consists of re- 
running all of the Level 4 test decks on the final version. If any new anom- 
alies or discrepancies turn up and are serious enough to require a PCR, the 
Erasable Memory Program option is weighted heavily against a manufacturing 
schedule slip. The First Article Configuration Inspection (FACI) is a formal 
review of all Level 5 testing results, anomaly reports, change requests, pro- 
gram notes, and operational restrictions. The end action of the FACI is the 
granting of approval to release the rope assembly for manufacturing. 
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Flight Support Activity 


The Flight Support Activity takes place after delivery of the Manufactured 
rope modules and centers around Level 6 testing as shown in Fig. 6. The KSTART 
tape is generated from the Preflight Erasable Load involving the Initial Data 
Load and any existing Erasable Memory Programs. Evaluation involves careful 
scrutiny of all parameters, by computer Program and by eyeball, to identify and 
assess changes from the previous KSTART tape. Additionally, the CSDL evaluation 
utilizes the Hybrid Simulator, the All-Digital Simulator, and the Systems Test 
Laboratory hardware installation. The testing is complemented by extensive 
mission-sequence testing on the Iron Bird Simulator at FRC, and involves pilot 
training, pilot procedures, and system performance. The test results are pre- 
sented at the Flight Readiness Review (FRR) , and any anomalies resolved, perhaps 
by modifying the operational envelope. FRR approval is required for flight go- 
ahead. Following a successful flight to test one DFCS capability, the Initial 
Data Load can be modified to test another capability, or to change the downlink 
coverage, and the procedure of Fig. 6 is repeated. 

Alternatively, the flight test results can indicate a serious need for a 
DFCS capability that does not exist in the rope. In this case, a PCR is sub- 
mitted to request that the capability be developed as an EMP. After assessment, 
if the PCR is approved, the development and test of the EMP is undertaken as was 
shown in the previous figure, Fig. 5. When completed, the verified EMP is in- 
corporated into the KSTART tape for Level 6 testing. 


Software Milestones 

The development activity is tracked by milestones. Schedule milestones 
were not treated with the level of formality accorded their Apollo counterparts. 
Small meetings of one or two technical personnel with management personnel marked 
many F-8 DFBW events. Nevertheless, schedule milestones were vital to a timely 
development and verification process. The major milestones are indicated in 
Fig. 2. 


The Preliminary Design Review (PDR) f or F-8 consisted of several meetings, 
each covering a specific area of interest. These were preliminary in the sense 
that changes were expected as subcontractors and customer had the opportunity to 
review carefully each other’s needs, plans, and suggestions. 

The Critical Design Review (CDR) also consisted of several meetings, each 
covering a specific area in minute detail. The CDRs for the Control System 
Specification and the Interface Control Document are specific examples. 

Level 1, 2, 3 Testing (Unit and Modular testing) allows tracking of units 
of software in the early stages of development when coding and verification are 
relatively independent of tight controls. 

Configuration Control marks the transition to tightly controlled software 
configuration and testing procedures. 
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Level 4 Testing (Interface testing) allows tracking of interfaces between 
modules of software. Program changes require written approval and all anomalous 
simulation behavior requires documentation, analysis, and resolution. 

Level 5 (Formal testing) allows tracking of software prototype. 

First Article Configuration Inspection (FACI) is a formal review of all 
aspects of prototype software. The final action is the approval of the final 
assembly for manufacture. 

Release-for-Manufacture — Following FACI approval, a weaving tape is gene- 
rated from the final assembly to be used for core-rope manufacture. 

Level 6 Testing (Mission Performance testing) is based on the KSTART tape 
for the particular flight. Evaluation consists of exercising the KSTART tape 
on the three CSDL Simulators and on the FRC Iron Bird System. 

A Flight Readiness Review (FRR) is conducted prior to each flight. A 
statement from CSDL is required concerning its review on the Preflight Erasable 
Load and KSTART tape. The initial FRR had the longest agenda. The review 
assessed the flight readiness of the primary control system, the backup control 
system, the flight vehicle subsystems, to name a few. Known anomalies and their 
avoidance or work-around procedures were discussed. Erasable Memory Programs 
were explained, both functionally and Operationally. The failure analysis studies 
were reviewed, as well as available documentation. Flight readiness reviews sub- 
sequent to the initial flight generally consider the current KSTART tape and any 
newly applicable areas. 


SOFTWARE VERIFICATION 


The software verification process is vital to the preparation of reliable 
high-quality software. A screening process is employed, whereby code is sub- 
jected to many tests representing many different situations. This approach to 
testing is one of diminishing returns: early tests show up most of the coding 

errors, but the later tests build confidence in the overall quality of the pro- 
gram assembly. Establishing the proper balance between insufficient and exces- 
sive verification testing is a critical task. Indeed, the verification process 
does not terminate with release-for-manufacture; it continues, in the hope of 
catching any remaining errors before they show up operationally with unexpected 
and perhaps dangerous consequences. 

The verification process cannot be separated from the assembly control 
process, at least prior to release-for-manufacture. The ultimate quality and 
reliability of code depends heavily on the verification process. The attainment 
of the verification goals involves far more than the execution of high quality 
object code available near the end of the software development cycle. Facili- 
ties are required in the early stages of program development when the code 
available is of low quality and may not even be executable. In the early stages 
a benign and cooperative environment is required; it must provide a detailed 
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visibility into the execution of code. Simplified , but fast-operating environ- 
ment algorithms are desirable. Extensive diagnostic capability is mandatory, 
involving both run-time and post-run software packages. As code quality is re- 
fined, the environment quality can be updated to include such factors as sensor 
errors and higher order effects. Ultimately the code should be exercised in a 
highly realistic environment including as much real hardware as possible. 


Software Verification Facilities 

Several distinct facilities were utilized during the DECS verification 
process. The complementary nature of their unique capabilities is significant. 
Each has contributed to the DFCS quality, and by its absence would have affected 
the development adversely, mainly in terms of schedule, but perhaps even in terms 
of operational performance. CSDL has utilized the All-Digital Simulator, the 
Hybrid Simulator, and the System Test Laboratory facilities for the software 
development and verification activities. NASA/FRC has utilized the analog 
Stage 1 engineering simulation, the bench lashup Stage 2 hardware integration 
simulation, and the Stage 3 Iron Bird Simulator for the systems design, hardware 
integration, design verification, and pilot training/evaluation activities. 

Each of these facilities has contributed to the overall success of F-8 
DFBW, but certainly the significant contributions to system integration have 
come from the Stage 3 Iron Bird Simulator. It was on this facility that signi- 
ficant hardware integration problems were first encountered. The Stage 3 piloted 
simulations gave insight for design-change evaluation. Stage 3 permitted real- 
time demonstration of failure effects, and permitted engineering preliminary 
and final design. Stage 3 was used for much supportive software verification 
and essentially all of the system design verification. For the flight testing, 
where CSDL's verification role was supportive, the Stage 3 simulation was 
especially important as the primary design, verification, and training tool. 

The All-Digital Simulator (ADS) at CSDL played the significant role in 
F-8 software design, development, and verification, primarily because of the 
powerful run-time diagnostic and post-run edit capability, as well as features 
such as repeatability and snapshot/rollback. Rigidly controlled simulator 
software provided a stable environment and ensured repeatability. 

The Hybrid Simulator at CSDL was a very useful tool during preliminary 
verification, primarily because of its real-time interactive capabilities. Its 
role was somewhat diminished because CSDL did not have DFCS design responsi- 
bility, which is where the real-time interactive aspects of hybrid simulation 
can vastly improve the control-system designer's efficiency. However, on two 
separate occasions, one being the time-critical development period between 
Stage 2 and Stage 3 simulation, NASA/FRC came to CSDL and conducted basic and 
detailed design on our Hybrid facilities. 

Piloted simulations early in the development phases can improve the 
overall quality of the end item, especially when schedules are tight. Pilot 
contributions cover a wide range of experience including such items as human 
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factors suggestions, functional change requests, performance and handling 
qualities evaluation, and safety considerations. 

The complementary nature of all-digital, hybrid, and hardware integration 
facilities is important. The ADS provides diagnostic and edit capability plus 
detailed hard-copy for documentation. The Hybrid Simulator is unmatched in its 
real-time interactive capabilities for preliminary design, parameter-variation, 
and sensitivity studies. The hardware integration facility represents the ulti- 
mate interface verification tool short of flight test. Here, interfaces are 
actually mated, often for the first time. Failures can be studied and pilot-in- 
the-loop evaluations based on a maximum hardware complement can be performed. 

Each of the design, development, verification, and training tools can play a 
key non-overlapping role. It is the complementary nature of each facility which 
should be emphasized and utilized for greatest program efficiency and end-item 
quality. 

A brief description of each of these facilities follows. 

CSDL All-Digital Simulator — The Apollo Digital Simulator is a basic tool 
developed and employed primarily to support the design, development, and veri- 
fication of Apollo Guidance Computer (AGC) programs. The simulator is entirely 
digital and consists of a number of programs implemented on a general purpose 
digital computer. It simulates the operation of the AGC in storage layout, and 
in detailed arithmetic and logical operation. Consistent with one's objectives, 
mathematical and logical models ranging from rudimentary to comprehensive may be 
selected to simulate the hardware and flight environment within which the AGC and 
its coding operate. For the F-8C, only the rigid body degrees of freedom are 
mechanized and there is no takeoff or landing capability. The BCS flight control 
system is not simulated, so controlled flight is possible only in the DFCS modes. 
The Pilot Action Simulator provides open-loop actions such as stick and rudder 
deflections, push button and trim switch activity, and DSKY operations. In ad- 
dition, the simulator has numerous on-line diagnostic features, a snap shop /roll- 
back capability, and extensive post-run edit capability available. The edit 
package provides for flexible run-time data storage and for post-run data retries 
al. The user has the choice of using standard edit programs or of writing his 
own. Extensive edit programs for plotting, computational verification, and 
formatting were developed for F-8 formal verification. Summary printing includes 
data on DFCS mode changes, timing, and computational delays. Plot variables in- 
clude numerous DFCS and environmental quantities. Timing data indicating duty 
cycle and job activity is plotted. A downlink processor edit was prepared to 
verify proper downlink operation. The simulation system is illustrated schemat- 
ically in Fig. 7. 

The CSDL Hybrid Simulator — The Hybrid Simulator is a combination of 
selected flight hardware used in concert with analog and digital computers to 
provide real-time simulated flight. The flight hardware consists of an LGC 
computer, a DSKY, and the coupling data units. The LGC memory is replaced by 
a Core Rope Simulator (CRS) , which provides a complete erasable memory as well 
as helpful features, such as the ability to monitor and change location con- 
tents, to stop at a location address, or to single-step the program. The IMU 
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is simulated with special-purpose electronics. Elements needing precision of 
storage,, as the trajectory dynamics, the aerodynamics , and the rotational 
transformations, are simulated in an XDS 9300 digital computer. The high- 
frequency actuator dynamics, the BCS loops, and some discrete logic are simu- 
lated on the analog computer. The algorithms for BCS control and BCS downmode- 
trim init ializat ion are simulated, but the cross-channel comparator and the 
hydrologic subsystems of the F--8C are not modelled* Also, provision is not made 
for a parking, landing, or takeoff capability. A minimal cockpit uses the 
Apollo three-axis rotational hand controller in place of stick/pedal controls. 
Cockpit instrumentation includes artificial horizon, altitude, airspeed, rate- 
of-climb, % thrust, g, angle of attack, and a mockup Mode And Power Panel for 
real-time man-in-the-loop simulations. Strip-chart recordings and initializa- 
tion printout are the only hard-copy output. The Hybrid Simulator runs in 
real time to allow man-in-the-loop testing, on-line debugging, and flexibility 
in verification procedures. The LGC can function alone or with the Simulator 
providing an environment; in the former mode it is available independently of 
the availablity of the hybrid facility. Reproducibility is not in general 
possible, but this is an advantage in that a realistic randomness is introduced 
into the testing. 

CSDL System Test Laboratory' — The System Test Laboratory (STL) is an 
Apollo hardware integration facility. A real IMU interfaces with the LGC, CRS, 
and DSKY. Uplink and downlink are operational. Channel inbit discretes can be 
set or cleared manually and independently. The aircraft and BCS systems are 
not simulated. A trace capability is available via the Apollo CORONER and off- 
line processing; this is the only hard-copy output from this facility. 

NASA/FRC Stage 1 Simulator — The Stage 1 Simulator was a preliminary de- 
sign tool used to develop the flight control system specification equations. 

Simple analog models and sample-and-hold networks were utilized. Linear analysis 
based on continuous and sample-data control system design, using root locus 
and w-plane techniques, provided backup for the simulation effort. 

NASA/FRC Stage 2 Simulator- — The Stage 2 Simulator was a hardware inte- 
gration and preliminary design evaluation facility. Breadboard lashup of major 
hardware components was first performed here. The LGC, the Program Analyzer 
Console (PAC, equivalent to the CRS), DSKY, IMU Gimbal Angle Simulator (GAS), 
and CDU package were involved. Aircraft and aero-surface servo actuator dynamics 
were modelled on a small analog computer. A rudimentary version of the DFCS and 
Operating System software participated. 

NASA/FRC Stage 3 Simulator — The Stage 3 (or Iron Bird) Simulator is an F-8C 
airframe that includes all key hardware in the configuration of the flight 
article, including the pallet mounting of the LGC computer, IMU, and CDUs. The 
BCS electronics, power supplies, and hydraulics are flight-article type systems. 
The manufactured core-rope or PAC software can be used as the LGC memory. Simu- 
lated trajectory dynamics and aerodynamics permit closed-loop simulations using 
the GAS. Simple external visuals, sideslip angle and horizon line with sky/ 
earth differentation, are provided on a TV screen mounted on the aircraft nose. 
Access to LGC and flight control system variables is by means of downlink with 
post-run editing or by DSKY display. 
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Software Verification Testing 

It is difficult to separate software development and software verifica- 
tion since both go hand in hand throughout the development phase. To consider 
software verification it is necessary to consider software development. Generally 
speaking, there are two categories of software design changes that contribute to 
program construction. 

(1) Developmental changes - these are creation of a new program or a new 
routine, or extensive changes within an existing program or routine. 

(2) Incremental changes - these are modifications to existing code that 
cause small alterations and repercussions. 

Clearly, a Developmental change has a major impact on the existing program and 
requires an extensive testing approach to assure that the new code works properly 
and does not interfere with other existing coding. It is equally clear that an 
Incremental change has a minor impact on the existing code and requires a local- 
ized testing approach. This is sort of by definition. However, it is not 
always clear into which of the two categories a given software change should be 
placed. Classification is a difficult problem and requires experience and 
thorough knowledge of the programs. For example, a one word change could re- 
quire extensive testing if that word were, say, a sample period affecting event 
timing. On the other hand, the replacement of one Boolean relationship by 
another, involving perhaps 30 words, could be local in effect and require only 
local testing. Thus, the full arsenal of testing is brought to bear on Develop- 
mental software, while a subset is used for Incremental software. 

Developmental Software Testing' — In order to test out developmental changes, 
the six official levels of testing are normally performed. These are Unit test- 
ing (Levels 1 and 2), Modular testing (Level 3), Interface testing (Level 4), 
Formal testing (Level 5), and Mission Performance testing (Level 6). The major- 
ity of the F-8 DFBW programming effort falls into the developmental category, as 
exemplified by the flight control coding, input/output processing, ground test 
programs, and special routines. Design changes that occur late in the develop- 
ment cycle are often accorded the Developmental treatment. Erasable Memory 
Program design is also in this category, although there have been exceptions. 

Incremental Software Testing — Incremental changes require adequate testing 
to assure that all paths in the program affected by the change are exercised. 

This may necessitate designing new tests for specific code changes . Incremental 
testing involves some combination of Unit testing, Modular testing, and Interface 
testing. Since all incremental changes become part of the program rope, they 
are automatically subjected to Level 5 and Level 6 testing. 

There have been a number of incremental changes in F-8 DFBW. Initially, 
much of the software (about 60%) came from the Apollo Lunar Module Program. 

Many areas of the code required minor incremental changes to meet F-8C requirement. 
Late in the development cycle, especially as the release-for-manufacture date 
approached, changes even to flight control code can often be treated as incre- 
mental, especially if significant Level 4 interface testing has already been 
completed. 
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Some Erasable Memory Programs have been classified as Incremental. In 
one case a two lines of code were added to an existing EMP to create the one- 
pulse rudder pedal deadband. The other case was a preflight checkout program. 
These have received minimal Level 4/5 testing. Conversely, other EMPs involved 
significant design changes deeply imbedded in interface or systems code: para- 

bolic shaping of stick inputs, or restart-triggering of BCS downmoding. These 
have received significant Level 4/5 testing, being developmental in nature. 

Special Testing — There are a number of special tests deserving of mention 
that establish confidence in the flight software mainly by failing to find a 
fault rather than by exhaustively proving every possibility. This approach is 
in general true when the number of ways to exercise the code becomes unwieldy. 
The fact that interaction between the Executive, interrupt processors, and ser- 
vice routines falls into this category can be overlooked. A specific example 
is restart testing where a large number of artificially generated asynchronous 
time- triggered and location-triggered interrupts exercise the restart protection 
mechanism. Stress testing involves testing operational sequences under abnormal 
conditions. Potential anomaly testing attempts to duplicate the event sequences 
which led to questionable behavior on another hybrid facility. Hybrid testing 
occasionally encounters unexpected behavior that is usually a hardware problem, 
but can be a software problem. If a problem is found, digital testing gives 
conclusive evidence. Alternatively, if no problem is found, a measure of con- 
fidence is restored. 

An ' eyeballing * effort was performed on the F-8 DBFW assembly just prior 
to release. Experienced Apollo programmers were assigned sections of the code 
to eyeball for errors, based on their accumulated experience. Several errors 
were uncovered, although off-nominal operational procedures would have been 
needed to encounter difficulties. The fact that errors were found gave weight 
to the effort as a worthwhile task. The absence of any serious errors, and the 
minimal number of errors encountered, added to the confidence level being built 
by the verification process. 


Input and Output Discrete Failure Effects 

A formal failure effects investigation was conducted late in the develop- 
ment cycle by CSDL and by other systems contractors. All interfaces were 
studied for fail-on and fail-off effects. Engineering analysis was the primary 
investigative tool, but simulated failures were utilized whenever pilot-in-loop 
problems were expected. To this end, a special version of the mainline program 
was created for the Iron Bird and was given the capability to fail any selected 
input/output discrete in the off-state or on-state. Failures were introduced 
during Iron Bird piloted simulations by a test engineer at the DSKY. The capa- 
bility enabled pilot training in recognition and recovery procedures. 

An important conclusion, of the failure analysis is that such studies 
should be initiated early in the preliminary design phase so that failure effects 
can be recognized and avoided by careful design of hardware, software, and 
interfaces. Early recognition leads to design changes that often can be incor- 
porated at no additional cost, whereas late recognition can be quite expensive. 
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Erasable Memory Programs 


The concept of an Erasable Memory Program only has application in refer- 
ence to a fixed memory computer when the capability to manufacture a new fixed 
memory is no longer available. Certainly, as long as the capability does exist, 
the redesign of a portion of the program or the inclusion of a new portion poses 
no particular problem even in a relatively mature program. In F-8 DFBW for ex- 
ample, the result of early Iron Bird simulations uncovered a hardware interface 
problem in that the anti-dropout filter in the CDU error counters interfered 
with restart recovery. Since the software was still under development, a 
straightforward redesign of the restart recovery routine was undertaken, in- 
cluding redevelopment and verification. On the other hand, when the ability 
to remanufacture the rope memory is gone, it is necessary to resort to an arti- 
fice, like erasable memory programming, if any change is to be incorporated into 
the program flow. If, however, one is dealing with a programmable memory com- 
puter, then post-release software changes are treated the same as pre-release 
software changes. The purpose of this section on EMPs then is to illustrate by 
example that sufficient cause for software changes can and will arise after 
program release, and to describe the F-8 DFBW experience. 

Some of the late Stage 3 Iron Bird discoveries were not compatible with 
software development schedules, bound as they were by the anticipated shutdown 
of the core-rope manufacturing facilities. Erasable memory programming and 
major hardware changes were required instead. For example, piloted simulations 
in early 1972 indicated pilot-response problems with certain computer failures. 
The work-around concept was straightforward and a software change could have 
been made, except that the DFCS was no longer software; core-rope manufacture 
was under way. Fortunately, an Erasable Memory Program (EMP-001, Restart 
Downmoding to BCS) could do the job, so remanufacture was not necessary. How- 
ever, the design and especially the verification tasks were much tougher for 
the EMP than they would have been for the fixed-memory equivalent, a character- 
istic of most erasable memory programming. Nevertheless, the flexibility pro- 
vided by last-minute software changes represents a major selling point for 
digital flight control. 

Design changes to minimize the effects of stick/pedal input quantization 
were not formalized until after the first flight. Hardware changes had been 
made earlier, prior to core-rope manufacture, but these proved to be inadequate. 
Again, an Erasable Memory Program (EMP-004 , Parabolic Stick Shaping) provided 
an acceptable approach, but the fixed-memory equivalent would have been easier 
to design, develop, and verify. Also, the DFCS computational burden would have 
been lower with the equivalent fixed memory code, and operational aspects would 
have been simpler. 

Problems do not always show up during the systems analysis and preliminary 
design phases, no matter ho^? detailed the activity, but instead crop up during 
the hardware integration phase, or even worse, conceal their identity until the 
flight test phase. F-8C, during high-q flight for example, encountered a single- 
pulse null shift in the output from the pedal LVDT, which supplies the rudder 
pilot commands to the DFCS. The phenomenon apparently has something to do with 
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airframe distortion at high-q flight conditions® Neither the Stage 3 Iron Bird 
Simulator nor preliminary analysis models could indicate such a phenomenon* In 
this case 9 the hardware problem of rudder bias shift was eliminated by softwares 
by inserting a one-pulse deadband (EMP-007, Single-pulse Pedal Deadband), There 
is a real motivation for a flight test phase , however brief , between the proton- 
type and production software* 


CONCLUDING REMARKS 


The F-8 DFBW is an experimental digital fly-by-wire testbed flight control 
system, implemented with Apollo off-the-shelf hardware* Existing off-the-shelf 
software and software control techniques were dictated by hardware as well as 
manufacturing schedule limitations* Software design was bottom-up* Time- 
efficient code was important because of LGC speed, (Some of the techniques 
discussed would not be applicable for a modern, faster, all core computer*) 
Despite the LGC fixed memory, post~manufacturing design changes to the Specifica- 
tion were possible through Erasable Memory Programs, Proof of the benefits that 
accrue from good software control and from careful and thorough verification 
testing is evidenced by the F-8 DFBW flight test program results: In a year and 

a half, 42 flights, totaling 58 hours of flight time, were made successfully 
without any DFCS inflight software failures or performance surprises. 
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TABLE 1 


APOLLO HARDWARE USED IN F-8 DFBW 


LGC 


DSKY 


IMU 


CDU 


PIPA 


PSA 

PTA 


LM Guidance Computer (approximately 2k of erasable and 36k of 
programmable fixed core-rope memory; programmable hardware- 
interrupt and software-executive systems; hardware restart 
logic, etc.)* 

(LM) Display and Keyboard (three 5-digit-plus-sign display 
windows; miscellaneous warning lights; keyboard including 0 
through 9, + , -, PRO (proceed), ENTR, CLR (clear), VERB, NOUN, 
etc; the DSKY is the computer /astronaut or computer /ground 
crew interfaced 

Inertial Measurement Unit (a three-gimballed gyroscopically- 
stabilized platform for the PIPA accelerometers; gimbal angle 
resolver and PIPA signals ultimately interface with the LGC; 
several platform alignment techniques are under LGC software 
control) . 

Coupling Data Unit (for analog-to-digital conversion of IMU 
gimbal angle indications; for digit al-to-analog conversion 
of LGC computer outputs; for control of IMU moding; includes 
failure detection; used to derive body axis angular rates). 

Pulsed Integrating Pendulous Accelerometer (three mutually- 
perpendicular contact-acceleration-sensing and incremental- 
velocity- indicating devices located on the IMU stable member, 
with a direct LGC interface; used to derive body axis normal 
and lateral acceleration) . 

Power and Servo Assembly (power supplies, amplifiers, etc., 
for inertial subsystem). 

Pulse Torque Assembly (input /output processing for inertial 
subsystem) . 
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TABLE 2 


HARDWARE UNIQUE TO F-8 DFBW 


MAPP 

IFB 

BCS 

DLC/IFR 

GSE 

SPCC 

CCS 


Mode and Power Panel (computer and IMU power control, auto- 
pilot gain and mode select /indicators , warning indicators, 
etc. 

Interface Box (junction box containing an Apollo DAC stick/ 
pedal comparators, special amplifiers, etc.). 

Backup Control System (triply-redundant stick/pedal to aero- 
surface open-loop control, with trim, hydrologic comparator; 
cross-channel comparator; etc.). 

Downlink Converter/Inflight Recorder (100 word-pair list 
every 2 seconds on a 20ms interrupt; recording on FM tape 
for post-flight processing/review) . 

Ground Support Equipment (the Apollo Program Analyzer Console 
(PAC) for simulating LGC hard-wire rope memory; the Uplink 
Converter (ULC) for preflight erasable loading and for DSKY- 
type program control via tape; the Ground Test Cart containing 
downlink converter/ground recorder, miscellaneous switches 
and indicators; etc.). 

Servo Pressure Control Console (PRI select/indicators for 
each axis; servo pressure switches and indicators for each 
BCS servo-valve and for PCS servo-valve pairs; each switch 
has three positions; OFF which disables that valve, AUTO 
which enables that valve, and MAN which overrides any auto- 
matic moding and locks that valve into the active state) . 

Coolant Control System (coolant for IMU, computer, etc.). 
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TABLE 3 


F-8 DFBW FIXED-MEMORY ALLOCATION 


F-8 DFBW Flight Control System (total) 


5586 

Body Rate/Acceleration Feedback 

320 


Generalized Feedback Filters 

1930 


Pilot Stick/Pedal Processing 

168 


Control Loop Equations 

1178 


Channel Monitor Routine 

523 


Gain/Mode Change Routine 

985 


Ini tialization/Res tarts /Miscellaneous 

482 


Ground Test Programs/Extended Verbs 


768 

Self Test/Check 


1436 

Fresh Start/Restart/V37/etc . 


853 

Display Interf aces /Pinball/etc . 


3578 

Interpreter /Executive/Waitlist/Downlink/Uplink/ etc . 


3830 

IMU Alignment, Compensation, and Tests/T4RUPT 


3263 


TOTAL F-8 DFBW FIXED-MEMORY USED 

TOTAL LGC FIXED-MEMORY (36 FBANKS AT 1024) 


19314 

36864 
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TABLE 4 


F-8 DFBW ERASABLE-MEMORY ALLOCATION 


Preflight Erasable Load (total) 389 

F-8 DFBW Flight Control System 169 

IMU Compensation/Alignment 33 

Erasable Downlink List 100 

Erasable Memory Programming (EMP-001,4,7) 87 

F-8 DFBW Flight Control System Working Registers 321 

Extended Verbs/Ground Test Prog/Miscellaneous 50 

Self Test/Check 263 

IMU Alignment/Perf Test/Ops Test 17 

Uplink/Downlink 32 

Display Interfaces/Pinball/etc. 56 

Executive/Waitlist/Service/Centrals/etc. 468 

TOTAL F-8 DFBW ERASABLE-MEMORY USED 1596 

TOTAL LGC ERASABLE-MEMORY (8 EBANKS AT 256) 2048 
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BCS 

GSE Interfaces 


Fig, 1. F-8C DFBW Aircraft and Hardware 




121 


Fig. 2. F-8 DFBW Chronology 
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Fig. 4. Program & Assembly Control Activity 






INITIAL DATA LOAD 
(FRC/CSDL) 
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Fig. 5. F-8 DFBW Software Development Activity 












FRR 
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Fig. 6. Flight Support Activity 










SIMULATOR INPUT 



FIXED MEMORY SIMULATOR OUTPUT 

FABRICATION 


Fig. 1 . Simulator System Schematic 



6. FLIGHT TEST EXPERIENCE WITH THE F-8 


DIGITAL FLY-BY-WIRE SYSTEM 


Kenneth J . Szalai 
NASA Flight Research Center 


SUMMARY 


Flight test results of the F-8 digital fly-by-wire (DFBW) control system are 
presented and the implications for application to active control technology (ACT) are 
discussed . The F-8 DFBW system has several of the attributes of proposed ACT 
systems , so the flight test experience is helpful in assessing the capabilities of those 
systems. Topics of discussion include the predicted and actual flight performance 
of the control system , assessments of aircraft flying qualities and other piloting 
factors, software management and control, and operational experience. 


INTRODUCTION 


In May 1972 the flight testing of the F-8 DFBW aircraft began. This aircraft, 
which used Apollo guidance and navigation system hardware , was the first to rely 
on a DFBW system for primary flight control. The design and development of the 
F-8 DFBW control system are described in references 1 and 2 and paper 2. This 
paper presents the major flight test results for the control system . A detailed 
description of the system's software development and verification is given in 
paper 5, and the backup control actuation systems are described in paper 3. 

The primary objectives of the flight tests were to evaluate the performance of 
the digital flight control system and to acquire operating experience with it. The 
program also served to determine whether the long-advertised advantages and 
capabilities of DFBW control systems could be realized . Many of these advantages , 
such as software flexibility , system reliability, and computational ability, make a 
DFBW system a logical candidate for active control technology applications . The 
F-8 DFBW control system had characteristics in common with systems proposed 
for ACT applications . Specifically , it was a highly reliable , full authority system 
that was committed for use from the first takeoff and landing . An analog control 
system was the only backup to the DFBW system. The mechanical controls of the 
basic F-8C airplane were removed before the first flight. 
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This approach parallels that taken toward the development of an active control 
system, both in terms of the importance attributed to the design of the control 
system and the reliability and management of hardware and software, and in terms 
of the requirement for detailed preflight testing . This paper emphasizes the aspects 
of the flight test program that relate to the broader considerations of an active 
control system. 


SYMBOLS 


a V a 2’ a 3’ b l’ b 2’ b 3’ 


C* = n^ - q, 


Z 57. 3g 


G(s) 

G(w) 

G(z) 

K 

K C * 

K 

P 

K 


K 


a 


M 

N c 


n r 


digital filter coefficients 


general s-plane filter 
general w-plane filter 
general digital filter 
general gain constant 
C* feedback gain, deg/g 

roll rate feedback gain, deg/deg/sec 

pitch rate feedback gain, deg/deg/sec 

yaw rate feedback gain, deg/deg/sec 

roll acceleration due to aileron deflection , 

2 

deg/sec /deg 
Mach number 

pitch acceleration due to elevon deflection , 
2 

deg/ sec /deg 

yaw acceleration due to rudder deflection , 
2 

deg/sec /deg 

acceleration along positive Z-body axis , g 
roll rate , deg/ sec 
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q 


r 

s 




5 

e 


T 


r 


eff 


<P 

* 

co 

Subscripts: 

d 


n 

n-1 


P 

sp 


pitch rate, deg/ sec 
yaw rate, deg/sec 
Laplace transform variable 
sample period , sec 
velocity , KIAS 
crossover velocity, m/sec 

sampled-data system frequency domain variable 

sampled-data domain transform variable 

incremental change 

general surface command , deg 

pilot roll stick deflection , cm 


horizontal stabilizer deflection , deg 

damping ratio 

pitch attitude , deg 

effective roll mode time constant , sec 

roll attitude , deg 
heading angle , deg 
natural frequency , Hz 

Dutch roll mode 
current sample 
last sample 
pilot 

longitudinal short period mode 
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steady state 


ss 

Z component along aircraft Z-body axis in positive (down) 

direction 

A 

( ) derived quantity ( ) 

ABBREVIATIONS 


ACT 

active control technology 

A/D 

analog to digital 

CAS 

command augmentation system 

D/A 

digital to analog 

DFBW 

digital fly -by -wire 

DSKY 

display and keyboard 

KIAS 

knots indicated airspeed 

PCM 

pulse code modulation 

PIO 

pilot-induced oscillation 

SAS 

stability augmentation system 


CONDUCT OF FLIGHT TEST PROGRAM 


Figure 1 illustrates the nature and sequence of the phases of the flight test 
program . The first three flights were made by using the proportional control , or 
direct, digital mode. The fourth flight culminated in a landing during which three- 
axis DFBW stability augmentation was used . The evaluation of the DFBW control 
system progressed rapidly from then on , and by the eighth flight all modes had 
been flown . The airplane was then evaluated in a variety of tasks , including 
ground-controlled approaches, gunsight tracking, mild aerobatics, and formation 
flight . The latter portion of the flight program concentrated on flying qualities 
assessments by additional pilots and on an evaluation of a minimum-displacement 
side stick that operated through the backup control system only (paper 3) . In total, 
58 hours were accumulated by six pilots during 42 flights. 

The F-8 DFBW system was flight tested within the flight envelope shown in 
figure 2. Most of the closed-loop evaluations were made at speeds between 250 knots 
indicated airspeed (KIAS) and 400 KIAS and altitudes from 6000 meters to 
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10,700 meters. Tests at low speeds (below 200 KIAS) were made with the variable- 
incidence wing of the F-8C airplane in the up position. Pilot ratings were given in 
accordance with the Cooper-Harper scale (ref. 3) . 

All flights were conducted during the daytime under VFR conditions. They 
averaged 80 minutes in duration. Each flight was monitored in a control room in 
which 36 airplane parameters were displayed . In addition , duplicates of the pilot's 
mode panel and servo status panel showed the state of the fly-by-wire control sys- 
tem. All parameters were telemetered from the aircraft's pulse code modulation 
(PCM) data acquisition system. 


CONTROL SYSTEM PERFORMANCE 


The digital flight control system consisted of pilot-selectable modes in each 
axis . The mode panel layout is described in paper 2 . The available modes are 
shown by axis in the table below : 



Axis 

Pitch 

Roll 

Yaw 


Direct 

Direct 

Direct 

Modes available 

SAS 

SAS 

SAS- 


CAS 

Test 

— - ~ 


The direct mode, which had no augmentation , and a stability augmentation sys- 
tem (SAS) mode were provided in each axis. A command augmentation system (CAS) 
mode was also available in the pitch axis . The roll test mode was used to facilitate 
comparisons between various SAS mode configurations. Block diagrams of the 
digital control modes are shown in figures 3 (a) to 3 (c) . 


Direct Mode 

The direct mode provided proportional control with no augmentation . Figure 3 (a) 
shows the direct mode mechanization, which was similar in all axes, Analog-to- 
digital (A/D) quantization of the stick outputs , effective quantization on trim due to 
sample rate , and digital-to-analog (D/A) output quantization are aspects of digital 
flight control that were apparent in this mode . Linear and nonlinear stick shaping 
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were used during the flight program . In the pitch axis » linear and parabolic shaping 
were used (fig . 4) , The Apollo A/D interface allowed a maximum of 45 quantization 
levels for full stick or pedal deflection in one direction. The Apollo computer D/A 
converter output quantization, which had ±384 levels, was approximately an order 
of magnitude finer than the stick A/D converter . The linear gearing mechanization 
resulted in a quantization level of 0.5.9° of horizontal stabilizer deflection when full 
pitch control authority was retained . During early flights , various linear gearing 
gains were evaluated . Table 1 summarizes the pitch quantization effects found with 
linear gearing. The threshold of quantization detection appeared to be from 0.1 5g to 
0.2g and 1.2 degrees per second to 1.5 degrees per second of peak pitch rate. 

Figure 5 shows an example of the thumping that the pilot detected at 365 KIAS as 
he attempted to increase pitch rate smoothly. This small airplane excitation was 
characteristic of the quantization effect in the pitch and roll axes resulting from 
control surface actuator response to staircase commands. 

The parabolic stick shaping resulted in a nonlinear quantization . The step size 
is shown in table 2 . This shaping greatly improved the fine pitch control of the 
airplane, while retaining nearly full stabilizer authority. With this mechanization, 
pilots reported that quantization was not apparent at speeds up to approximately 
400 KIAS . In the roll axis , stick quantization had to be reduced by changing the 
linear gearing about the center stick position. The initial value of 1 .04° of total 
aileron command was changed to 0.36°, This reduced the minimum commanded 
roll rate from 8.32 degrees per second to 2.90 degrees per second at 250 KIAS and 
yielded acceptable roll control around trim . The only noticeable effect of quantiza- 
tion in the yaw axis was in random 1-bit commands that were observed at 400 KIAS . 
Lateral acceleration peaks of 0.03g due to 1-bit or 0.38° rudder surface commands 
were observed. This problem was corrected by writing software in erasable memory 
to allow a 1-bit deadband in the rudder pedal command . No other rudder pedal 
quantization effects were seen . 

It should be noted that the ±45 quantization steps available represented less than 
a 6-bit A/D conversion . A 12-bit (11 bits plus sign) A/D capability is available 
today. This yields a resolution nearly 50 times as fine as that in the F-8 DFBW 
system. At the most sensitive F-8C flight condition, which was Mach 0.86 at sea 
level, a 12-bit A/D interface would have allowed digital commands as small as 
O.OOlg, assuming linear gearing and full surface authority. Therefore it is safe to 
assume that the quantization effects of a modern A/D interface would be negligible 
and undetectable by the pilot . 

Quantization of pilot trim inputs due to sample rate also became apparent in the 
flight program. In the F-8 DFBW mechanization, trim command discretes were 
sampled every 90 milliseconds . Based on the pitch trim rate value of 1.25 degrees 
per second, the minimum software command was 0.11°. This command is nearly 
twice as coarse as the D/A converter quantization steps of 0.069° for the horizontal 
stabilizer . This effective trim quantization was a factor in making precise trim of the 
F-8 DFBW aircraft difficult at a target speed and altitude. 

The pitch trim discrete inputs should have been sampled at the major cycle 
sample period of 30 milliseconds, which would have resulted in a trim quantization of 
0.0375°. This would have taken full advantage of the output D/A quantization. This 
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points out the need to sample beep trim discrete inputs at a high enough rate to 
yield acceptable output quantization. In some cases , trim discretes may have to be 
sampled at rates higher than the major cycle sample rate, if fine trim resolution is 
required . 


Stability Augmentation System Mode 

The nominal SAS configurations flown are shown in figure 3 (b) , Body axis 
rate was estimated by filtering the transformed inertial attitude from the Apollo 
inertial platform . Compensation filtering and gain were placed in the feedback 
path. There was an aileron-to-rudder interconnect in the yaw SAS mode only. 

The stick and trim processing were identical to those in the direct mode. A rate 
reasonability check was applied to the final command , and an automatic transfer to 
the direct mode resulted if the reasonability threshold was exceeded. 

The digital SAS modes operated as expected . This is important from the point 
of view of the sampled-data design process . The acceptance of digital control 
systems depends in large part on the ability to predict system performance 
accurately . 

The digital SAS loops were designed by using sampled-data analysis methods , 
especially the z-plane root locus method . The linear system model used in the 
pitch axis is shown in figure 6. An ideal pitch rate signal was assumed. At first, 
the rate estimation filter that acted on pitch attitude was used in the model , but the 
resulting pitch rate signal was found to be nearly identical to that for the ideal 
case at the F-8C short period frequencies. Neither the highly nonlinear A/D 
conversion of gimbal angles nor the axis transformation steps were modeled . Four 
symmetrical bending modes were included in the analysis . 

The z-plane root locus for the pitch SAS mode without lead-lag compensation is 
shown in figure 7 (a) . A lead-lag filter was designed to improve the performance 
of the pitch rate loop in increasing the short period damping ratio . A w-plane 
frequency response was used to select the compensation root locations . The w-plane 
compensation, 


G(w) = 


w/0.1 + 1 

w^/0.16 + w/ 0.286 + 1 


2 - | 

was transformed to the z-plane by w = — - ^ and yielded a discrete filter , 


G (z ) = 


1.023(1 + z 1 )(1 - Q.818z 1 ) 
1.0 - 0.976z _1 + 0.349z~ 2 


The root locus for the compensated system is shown in figure 7 (b) . Higher short 
period damping ratios were achieved by using the lead-lag filter , as one would 
expect in a continuous system., A comparison between the predicted effects of the 
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compensation filter and those measured in flight is shown in figure 8, where the 
increment in short period damping ratio is shown for three flight conditions. The 
sampled-data system prediction is good . 

The improvement in airplane response with the pitch SAS is evident in the 
flight time histories in figure 9. Figures 10(a) to 10(c) show a comparison of 
predicted with measured damping in the three airplane axes . Agreement is good 
for the longitudinal short period (fig. 10(a)) and Dutch roll (fig. 10(b)) modes. 

At low gains , rate estimation quantization and actuator friction restricted surface 
motion at the angular rates tested , and , as a result , the SAS loop was less effective . 

The flight performance of the digital roll SAS mode is illustrated in figure 10(c) . 
Since the roll rate response that resulted from a step lateral stick command was 
contaminated slightly by the Dutch roll, an effective roll mode time constant 
corresponding to the time between the initial roll rate response and the time when 
63 percent of steady state was achieved was used . Yaw SAS was engaged on all 
runs to reduce the Dutch roll contamination. The predicted trend, which was for 
decreasing roll mode time constant with increasing roll SAS gain , is clear , although 
a bias of approximately 0 . 05 second is apparent . One factor that contributed to 
this bias was the nonideal pilot step input , which resembled a rapid ramp . This 
resulted in a slightly higher than predicted effective time constant , since the 
predicted value was based on a perfect step input . 

To further evaluate the sampled-data analysis method , the pitch rate feedback 
gain was increased in flight until the compensation root approached neutral stability. 
Figure 11 shows the z-plane root locus prediction of the neutral stability point to be 
in good agreement with the flight-measured results . 


The SAS modes also operated well at low speeds . Pitch SAS results are shown 
in figure 12(a) . A washout filter was designed for low speed operation in the 
s-plane as 


The discrete washout filter formed by using the bilinear transformation for real 
roots was 


GU) - 0.9852 , 2(1 . - . 0 
1 - 0.9704z 1 

The results of the washout filter addition to the feedback loop on aircraft response 
was as expected (fig. 12(b)) . The highest loop gains used in flight were 
|K | =3.8 in pitch, |K L g j =3.2 in roll, and |K r Ng | = 1.2 in yaw . One 
^ e ^ a r 

further observation is appropriate . The Apollo inertial platform was designed for 
precise navigation. It had an A/D interface, the coupling data unit, that was not 
designed to facilitate rate estimation . Even so , the derived body rate provided a 
signal that could be used satisfactorily for the F-8 DFBW damper modes. 
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Command Augmentation System Mode 


The pitch CAS mode block diagram is shown in figure 3(c) . Derived normal 
acceleration is blended with derived pitch rate to form the feedback signal , C* 

(ref. 4) . A forward loop integrator and bypass path provided zero steady state 
error and resulted in neutral aircraft speed stability . The cos 0 correction term 
eliminated acceleration feedback in a steady climb or descent . The pilot stick and 
trim interface with this mode was the same as in the direct and SAS modes . 

As was the case in the pitch SAS mode, the performance of the digital CAS mode 
was essentially as predicted by linear sampled-data systems analysis. However, 
gain values selected for the C* feedback gain during the preliminary design could 
not be used in flight. The reasons for this are traceable to the noise problems 
associated with using rates and accelerations derived from the Apollo inertial 
measurement unit and interface hardware. These problems are not inherent in a 
digital mechanization . For acceptable noise levels at the horizontal stabilizer , 
the C* feedback gain was too low for optimum response. The flight performance 
of the CAS mode was reasonable at low speeds, however. Figures 13(a) and 13(b) 
compare the F-8 DFBW C* response in the direct and CAS modes at 180 KIAS and 
250 KIAS, respectively. These responses , normalized to the final value, are shown 
with respect to the C* power approach and cruise design envelopes , respectively . 
The improvement in airplane response is substantial. The 250-KIAS response 
illustrates the problem encountered in CAS with insufficient loop gain . The short 
period response was satisfactory , but the aircraft exhibited drift in the 3- to 
8-second time period that was actually the first-order mode resulting from the 
forward loop integrator. This effect was apparent to the pilots. 

The CAS mode provided the expected neutral speed stability. Figures 14(a) 
and 14(b) show the phugoid response of the F-8 DFBW aircraft in the direct and 
CAS modes, respectively. The aircraft, trimmed at 180 KIAS, was slowed approxi- 
mately 10 KIAS , where the stick was again centered. The CAS mode held zero pitch 
rate while the aircraft slowed to a new steady state speed of approximately 138 KIAS . 
Normal acceleration (not shown) remained constant at nearly lg during the maneuver , 
while angle of attack (not shown) , which started at 3.5°, stabilized at 10°. 

The effectiveness of the CAS mode in suppressing transient effects is shown in 
figure 15, where the response of the F-8C airplane is compared in the direct and 
CAS modes during a wing transition (wing incidence changes from -1° to 7°) . 

Both responses were without pilot inputs. 

Although the performance of the CAS mode was degraded by the limitations of 
the Apollo hardware, the control system design was relatively straightforward, and 
flight results again matched predictions quite closely . 


Implications of Digital Fly -By -Wire Design for Active Control Systems 

The flight verification of the F-8 DFBW control system design was encouraging 
from an active control technology standpoint. First, the body of continuous 
control system design experience is largely applicable. In fact, if there is a 
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reasonable separation between the half sample frequency and modes of interest , the 
design can be accomplished in the continuous domain and then exactly transformed 
to the discrete domain by using the bilinear transform . Furthermore , direct z-plane 
design is also possible. The most serious difficulty about using the latter approach 
is lack of experience with direct digital design , 

The entire F-8 DFBW three-axis digital flight control system problem could be 
solved by the Apollo computer in less than a 30-millisecond major cycle time period. 
The capabilities of a current high performance computer and those of the Apollo 
computer are: 


Apollo computer Current computer 


Memory cycle time, psec 

11.7 

1.0 

Add time, psec 

23.4 

2,5 

Multiply time , psec 

46.8 

6.0 


The table shows that a state-of-the-art computer can be expected to be an order of 
magnitude faster than the Apollo computer . This suggests a sample rate or job 
capacity increase of the same magnitude . Although computer sizing must await a 
specific ACT configuration , the capability of today's computers would appear to be 
more than adequate for the control system tasks envisioned. 


PILOTING FACTORS 


Considered in conjunction with the control system performance reported in the 
previous section , the handling qualities results confirmed the feasibility and 
utility of a digital fly-by-wire control system . 


Handling Qualities Summary 

The flying qualities of the F-8 DFBW were evaluated by the pilots in a variety of 
tasks , including simulated instrument cruise, large or abrupt maneuvers, ground- 
controlled approaches, gunsight tracking, and close formation flight (paper 7) . 

Figure 16(a) summarizes the longitudinal handling qualities results for small 
instrument maneuvers, and figure 16(b) summarizes the results for large maneuvers. 
The piloting tasks and the comment guide used for these evaluations are given in 
the appendix. In figure 16(a) the comments and ratings are typical of the findings 
of pilots at low-to-moderate cruise speeds (less than 350 KIAS) . For large maneuvers, 
the pilot rating improvement with control system sophistication was evident . Pilot 
acceptance of the SAS and CAS modes was expected on the basis of the control 
system and vehicle response characteristics reported in the previous section. Some 
pilots did report a long period overshooting tendency in the CAS mode for certain 
maneuvers where steady state pitch rates had to be arrested. This correlated with 
the first-order integrator mode present in the CAS step response. 
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Figure 17 is characteristic of the improvement in pitch control with digital SAS 
as seen by the pilots in a wind-up turn. In the direct mode, the F-8C airplane 
displays its undesirable short period damping . The same maneuver could be 
performed easily and precisely in the pitch SAS mode . 

Ground- controlled approaches were flown down to approximately 60 meters 
under simulated instrument flight conditions in the various digital modes . Fig- 
ures 18(a) and 18(b) show typical pilot comments and ratings in the lateral- 
directional and longitudinal axes . The pilot ratings reflect the improvement in 
Dutch roll damping provided by the yaw SAS mode. In figure 18(b) pilot A objected 
to a slight long-term overshooting tendency in the CAS mode. 

The tracking performance of the F-8C airplane with the digital control system 
was degraded by stick quantization problems in both the pitch and roll axes . The 
parabolic pitch stick shaping resulted in unacceptable quantization steps at large 
aft stick positions (table 2) . This degraded the pitch control of the airplane so 
much that even augmentation did not significantly improve the tracking performance. 
Some improvement with roll and yaw SAS was evident in a 2g gunsight tracking 
maneuver , as the time histories in figure 19 and the associated pilot comments and 
ratings in figure 20 show. The augmented time histories in figure 19 correspond to 
a yaw SAS gain, , of 0.4 deg/deg/sec. 

Close formation flight revealed deficiencies in the flying qualities that were 
often not apparent in maneuvers where the pilot was not required to be "in the loop" 
as tightly . The improvement shown in figure 21 of the longitudinal flying qualities 
with digital augmentation is typical . Pilot comments reflected the decreased work- 
load evident in the time history. Barrel rolls, aileron rolls, and wingovers were 
performed in all control modes. Pilots noted little difference in their ability to 
perform these maneuvers between the direct and augmented modes , perhaps because 
these maneuvers tended to be more open loop in nature. 

Except in maneuvers where the coarse stick quantization problem was over- 
riding, as in the gunsight tracking maneuver , the DFBW control system markedly 
improved the flying qualities of the unaugmented F-8C aircraft. Because of the 
control system performance described in the previous section, this was not 
unexpected. One pilot who flew F-8C airplanes regularly found the F-8 DFBW 
vehicle superior even to a standard F-8C airplane with normal augmentation . He 
noted in particular the lack of the usual mechanical control slop . 

The results of the flying qualities evaluations , coupled with the control system 
performance previously described , indicate that a DFBW control system can perform 
as well as or better than a conventional control system . The only serious problems 
encountered were due to the limitations of the Apollo system hardware, which 
would not be factors in a current design . 
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Pilot Interface With the Digital-Fly-by -Wire System 


The F-8 DFBW system was designed to permit a simple, yet flexible, interface 
with the pilot . The normal astronaut interface with the Apollo guidance and 
navigation system was a display and keyboard device (DSKY) that allowed the 
operator to display memory contents , load erasable memory , or initiate special 
programs. The versatility of this interface was important to the design and test 
engineers during the development and flight test program , but it was not made 
available to the pilot because of its complexity for a single place aircraft . The 
pilot’s only interface with the digital computer was through a mode and gain panel, 
which is described in paper 2. The pilot's gain switch mechanization in software 
contributed to the rapid, safe flight checkout of the digital flight control system. 
Table 3 lists the different digital control system parameters that were tied to the 
gain switches during the flight test program. In all, 105 parameters could be 
connected via software to the three gain switches . 

With this gain mechanization , different control system parameters could rapidly 
be selected and optimized during the research program . More important , the gain 
switches allowed the designer to make use of the pilot’s capabilities. Nominal 
values of critical gains that were established during the simulation phase were 
placed on the gain switches along with larger and smaller values. The pilot could 
change the gain values at any time. For example, one of the gain switches was for 
pitch gearing. During the first flight, when the effects of the pitch quantization 
and sensitivity had not yet been established , the pilot took off in the nominal gain 
position. By 13 minutes after takeoff at 300 KIAS , he had reduced the gearing 
10 percent because of pitch control sensitivity . Before landing he evaluated three 
gain positions, finally selecting the nominal gain value 2 1/2 minutes before touch- 
down. Apart from its research value, this type of gain selection and evaluation 
gave the pilot an important degree of freedom. Switch arrangements like this are 
not unique to digital flight control systems , but the ability to designate such a large 
number (105) of parameters for this use with virtually no hardware impact is 
unique to a digital system . 

This kind of flexibility can be carried in a digital computer with only a small 
increase in software complexity. This mechanization approach would also be 
advantageous in an active control system design , because the F-8 DFBW experience 
showed that the pilot could rapidly and safely assess open- and closed-loop gain 
parameter variations about the nominal design point during flight . 

Flight experience also showed the multimode digital flight control system to be 
safe and valuable for both research and proof testing phases of the flight program . 
The low mode of control in the primary digital system (direct) provided a fallback 
position for both the pilot and the system. Since the direct and augmented modes 
were fully synchronized , they could be switched manually or automatically under 
any dynamic conditions with a minimum and safe aircraft response transient. The 
pilots took advantage of this multimode mechanization to diagnose the cause of flying 
qualities deficiencies by comparing airplane response in each mode . 

Like the gain switch arrangement , the multimode mechanization makes use of 
the online monitoring capabilities of the pilot . It too is a good candidate for active 
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control mechanization, especially for the first few flights. One problem was 
encountered with this approach . Mode changes could occur without being commanded 
by the pilot due, for example, to a reasonability test. The mode panel display light 
configuration would change , but this was not easily detected by the pilot . A master 
caution and annunciator warning of any uncommanded mode change should have 
been incorporated . 

In summary , software flexibility allowed the test pilot to use his real-time 
diagnostic capability and to make control system alterations. The alterations could 
be made with almost no hardware impact and with minimum additional software com- 
plexity. These concepts are applicable to early flight testing of full time active 
control systems. 


MANAGEMENT OF FLIGHT SOFTWARE 


The flexibility and versatility of digital flight control system software carries 
with it the need for software management and control . Perhaps no other area of 
digital fly-by- wire control raises as many questions and doubts as software 
reliability. The concern centers on whether it is possible to achieve reliable man- 
rated flight control software at a reasonable cost and whether software flexibility is 
compatible with software reliability in a practical application. The F-8 DFBW 
experience indicates that both questions can be answered yes. 

Two aspects of the F-8 DFBW flight test program are of significance to full 
authority, man-rated digital flight control software. First, not a single software 
programing error was discovered during the flight test program . Much of the 
credit for this is due to the thorough verification procedures and facilities developed 
for the Apollo software, which were also used during the F-8 DFBW program, 
although on a smaller scale . The procedures are described in detail in paper 5 . 
Secondly , not a single incorrect erasable memory constant propagated to a flight 
tape that was used to load the Apollo computer . These results are significant 
because an active control system must achieve the same level of reliability as the 
basic airframe. The software, in turn, is central to the active control system's 
reliability , because even though an active control system would have redundant 
digital channels, the software would be common to all, as it was in the F-8 DFBW 
system . For this reason , it is worthwhile to examine the software management 
procedures used in the F-8 DFBW program. 

Figure 22 (a) outlines the procedures established to control software programing 
changes during the flight program . These procedures were used three times after 
the hardwired memory was manufactured and before the first flight . The three 
special purpose programs written into the erasable memory consisted of pitch and 
roll parabolic stick shaping , yaw pedal deadband , and a special failure mode 
monitor . 

The software control board in figure 22 (a) consisted of representatives from 
control system engineering, project management, operations, and the pilots' 
office. Step 7 in figure 22 (a) consisted not only of checking out the new code but 
rerunning former , documented tests on related code to insure proper program 
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interaction, if any. Extensive files of detailed all-digital simulation runs generated 
during the initial verification phase were kept for comparison with identical runs 
with the modified code . This permitted short turnaround time for new additions 
to the code. 

Figure 22(b) shows the steps taken in the alteration of control system constants 
in the erasable memory. In total, 394 erasable memory locations had to be loaded 
for each flight . Table 4 gives a breakdown of these constants . Sum checks and 
built-in data transmission checks in the Apollo computer made it possible to insure 
that the desired octal numbers were loaded into the computer . 

Making sure that the 168 control system values loaded were those actually 
desired was less straightforward . A punched tape was used to load the computer . 
During the flight program six tapes were manufactured , each of which represented 
a different flight control system configuration . 

Because the Apollo digital computer is a fixed-point machine, there were 
magnitude restrictions due to program scaling on most parameters. A variety of 
other restrictions combined to create a formidable set of rules for the set of control 
system constants. 

An off-line diagnostic digital program (step 3 of fig. 22(b)) , which ran on a 
data processing computer , was developed to ease the burden of verifying the 
correct content of the master load list, which was kept on standard punch cards. 

One task performed by the diagnostic program was to check each of the 394 constants 
against a previously drawn list of reasonable values. This reasonability list was 
constructed after considerable experience was gained from iron bird simulation, 
but before the first flight tape was made. The limits were set to encompass the 
expected or allowable operating range of each variable. Deviations from reason- 
ability limits were flagged by the program as major errors and had to be corrected 
or signed off by the responsible engineer . 

The program also reconstructed digital filter forms from their coefficients and 
computed their vital characteristics, such as root location, steady state gain, and 
absolute root magnitude in the z-plane. This was helpful in the case of digital 
filters , the characteristics of which are not as obvious as those of continuous 
filters . 

One aspect of software control became apparent during the ground testing and 
simulation of various control system gain configurations . When many gain changes 
had been made and the precise configuration was in doubt , it was only necessary 
to dump the contents of erasable memory on magnetic tape to create a complete 
description of any given configuration . This capability proved to be extremely 
valuable in the control system refinement stage , and it is unique to a digital 
mechanization. It was also possible to revert to the baseline configuration merely 
by reloading memory with the baseline punched tape . This required approximately 
3 minutes on the Apollo computer . 

In summary, the F-8 DFBW flight experience indicates that highly reliable flight 
software can be generated and maintained, but that it requires thorough control. 
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Because the F-8 DFBW program was intended for research, the software program 
was made more flexible than would be necessary for a production airplane . Even 
with this flexibility , the software was easily managed with diagnostic digital 
programs, resulting in high overall system reliability. In fact, changes were made 
to the digital system more confidently than they were to the airplane's analog 
systems because there was no hardware impact. 

Partly because of the built-in flexibility of the control system mechanization , 
only minor changes had to be made to the basic program during the flight test 
program . More program changes would be expected in a prototype system develop- 
ment , thus increasing the need for strict configuration management for software . 

The F-8 DFBW flight results confirmed that a DFBW control system could be 
used in an active control application from the standpoint of software reliability and 
system flexibility . 


OPERATIONAL FACTORS 


Reasonability Checks 

The software reasonability checks used in all augmented modes are surface 
command rate checks made over one sample period (30 milliseconds) . Exceeding 
the threshold value in any axis resulted in an automatic downmode to the direct 
mode in that axis . The threshold values per sample period that were found to be 
usable in flight were 4.5° in pitch, 13.0° in roll, and 8.0° in yaw. These were the 
smallest values that allowed nearly any pilot input . Ten downmodes occurred in 
flight. All except four were directly related to sharp pilot step inputs that were 
made for test purposes. The other four were due to noise peaks that resulted from 
the angular rate derivation. At least one of these occurred in each axis. 

The reasonability check was designed to detect abrupt command changes due to 
sensor failures or major software faults. Experience with the F-8 DFBW system 
indicated that the threshold rate limit could be reduced by at least 50 percent in 
all axes for an operational fighter . If unreasonable commands were allowed to 
exist for 100 milliseconds (approximately three sample periods) , nuisance down- 
modes would be eliminated without sacrificing protection . 


Digital System Reliability 


The F-8 DFBW digital control system utilized a single highly reliable digital 
computer . This configuration would probably not be used in an active control 
system . However , the reliability requirements of the F-8 digital system are repre- 
sentative of the requirements of an ACT application . First , no single failure was 
permitted that would have resulted in the generation of a hazardous control surface 
command. Second, any serious failure within the digital system had to be detected. 
In the F-8 DFBW airplane, the failure warning signals were used to transfer control 
to the analog backup control system. In a redundant digital control system , 
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operation would continue on the remaining good digital channels after a component 
failure. F-8 DFBW reliability experience is nevertheless applicable to active 
control technology in terms of failure detection and also in terms of the features 
of the digital mechanization that led to a high level of confidence in this system. 

No hardware failures occurred in the primary digital flight control system on 
any flight . This is not surprising in view of the demonstrated in-service reli- 
ability of the Apollo guidance and navigation equipment . The discrepancies noted 
in the DFBW flight system, excluding the actuators and their drive electronics, 
are listed in table 5 . Three component failures occurred in two systems during the 
2500 hours of operation (items 4, 5 , and 10) , Item 4 would have had no impact on 
normal flight operation. The failure monitor in item 5 was added to the system 
during the flight program to protect against a potentially hazardous single-point 
failure mode in the Apollo computer output interface hardware . The monitor box 
failed before its first use in flight, although it failed in the proper "safe" mode 
(transfer to the backup control system) . The roll stick circuit failure (item 10) 
would have caused a downmode to the backup control system in flight , as it did 
on the ground . There were no unresolved anomalies. 


Preflight Procedures 


Two preflight test procedures were used for the digital system, The first was 
a 1-hour test done on the system in the hangar the day before flight. Electrical 
and hydraulic power were external. The second procedure was part of the total 
aircraft preflight immediately before flight , with engine- supplied electrical and 
hydraulic power . The elements of the hangar and flight line preflight tests are 
listed in table 6 . Virtually all the hangar tests except the specialized inertial 
measurement unit checks and the detailed surface deflection measurements were 
repeated . Although the digital system's flight line preflight was not optimized in 
the built-in software , it took only 10 to 15 minutes , 

One sensitive preflight test was the computer activity check, A program in the 
erasable memory was used to measure computer duty cycle indirectly, by detecting 
idle time over a several second interval. In a given configuration, the duty cycle 
was consistent within a few percent over several time intervals. This test confirmed 
proper software operation to a high level of confidence. 

During the investigation of the anomalies that occurred on both the iron bird 
and the F-8 DFBW airplane , it became apparent that it was possible to determine 
the health of the digital control system rapidly and confidently . The state of the 
digital control system could be determined in less than 5 minutes by running a 
self-test and by monitoring the internal control system parameters on the DSKY in 
the flight control modes . The monitor feature was indispensable during the flight 
test program . With half a dozen keystrokes , three control system parameters could 
be displayed in engineering units and in decimal format . The display was updated 
every second, so even under dynamic conditions the display was intelligible. This 
monitor format permitted the immediate checkout of virtually any part of the control 
system. Any future digital flight control system should incorporate such display 
software capability . 
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The ability to quickly and confidently assure proper control system performance 
is of paramount importance to active control systems. The repeatability of the test 
results of the F-8 DFBW program inspired enormous confidence in the operational 
readiness of the system before flight . Even personnel not thoroughly familiar with 
the digital control system were able to perform detailed tests of the system because 
of the well-designed display and monitor software . The component failures that 
did occur during ground operation were all detected by the system itself. 


CONCLUDING REMARKS 


The F-8 digital fly-by-wire (DFBW) flight program showed the feasibility and 
advantages of DFBW control for aircraft . Even with hardware designed a decade 
ago for space applications » an Apollo computer easily handled the F-8 DFBW flight 
control computation task. This demonstrated the inherent flexibility of a digital 
system . 

The following conclusions can be drawn on the basis of the F-8 DFBW flight 
test program. 

(1) Existing design tools , such as the w -plane frequency response and the 
z-plane root locus, are suitable for the synthesis of digital flight control. 

(2) Flight performance of the digital flight control system verified the accuracy 
of the sampled-data design results for contemporary command and stability augmen- 
tation system modes . 

(3) Pilot opinion correlated with that expected on the basis of the control system 
performance. 

(4) A modern digital control system design would display no quantization effects 
noticeable to the pilot . 

(5) The flexibility of the digital control system permits effective use of the 
pilot in configuration optimization in early flight test stages . 

(6) Man-rated software can be safely managed while retaining a high degree of 
flexibility. The use of off-line diagnostic programs greatly reduced the engineering 
burden of software management. 

(7) Digital system integrity can be rapidly and confidently determined in pre- 
flight tests by using flexible and extensive engineering interfaces . 

The implications of these results for an active control application can be broadly 
stated as follows: 

(1) A DFBW control system possesses the computational ability and flexibility 
necessary for advanced active control applications . Computer hardware advances 
are leading control system applications . 
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(2) Reliable software can be produced and is not an obstacle to an active control 
application . 

(3) The fault detection and preflight test technology necessary for digital 
control systems exists. Full realization of DFBW potential awaits the successful 
demonstration of reconfiguration and normal operation after component failures in a 
practical redundant system. 

There was no flight or ground experience that would indicate that a DFBW 
system could not be used in an active control technology application. In fact, the 
F-8 DFBW flight program achieved in practice the advantages so long attributed to 
a DFBW control system and confirmed the suitability of digital control for active 
control technology . 
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APPENDIX 


PILOT COMMENT GUIDE FOR LONGITUDINAL HANDLING QUALITIES 


Instrument Flight Maneuvering 

(1) Trim the aircraft to desired speed at a zero rate of climb 

(2) Make small heading changes of less than 30° 

(3) Make air traffic control altitude changes 

(4) Make air traffic control speed changes 


Comment on: 

(1) The ability to fine trim the aircraft 

(2) The need to monitor the pitch axis during lateral-directional tasks 

(3) The ability to make accurate changes in attitude 

(4) Stick breakout and deadband forces 

(5) The acceptability of these aircraft characteristics for fighter aircraft 

(6) Overall longitudinal pilot rating 


Large or Abrupt Maneuvers 

(1) From trimmed flight, quickly establish a l,5g to 2.5g turn 

(2) Recover to trimmed, level flight 

(3) Quickly set up a constant speed high performance climb by selecting a target 
pitch attitude and throttle setting 

(4) Recover to trimmed , level flight at target altitude 

(5) Increase speed 50 KIAS , and retrim 


Comment on: 

(1) The ability to control attitude and g . Tendencies to overshoot or for pilot- 
induced oscillations 

(2) The ability to restore the aircraft to trimmed flight 

(3) Stick breakout and deadband forces 

(4) The lag in aircraft response to stick inputs 

(5) Residual small- amplitude oscillations 

(6) The acceptability of these characteristics for fighter aircraft 

(7) Overall pilot rating for the large or abrupt maneuvers 
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TABLE 1. -PITCH STICK QUANTIZATION EFFECTS WITH LINEAR GEARING 
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TABLE 2. -QUANTIZATION MAGNITUDE FOR FULL AUTHORITY 
PARABOLIC PITCH STICK SHAPING 


Nominal stick position , 
cm 

Quantization size, 

deg 

0 

0.1 

5 

CO 

O 

10 

0.7 

15 

1.2 


TABLE 3. -DIGITAL CONTROL SYSTEM PARAMETERS 
TIED TO GAIN SWITCHES 


Axis 

Mode 

Description 

Pitch 

Direct 

Stick gearing 

Pitch 

SAS 

Pitch rate feedback gain 

Pitch 

SAS 

Type of digital filter 

Pitch 

CAS 

Forward loop integrator gain 

Pitch 

CAS 

C* feedback gain 

Pitch 

CAS 

Pitch rate blending gain 

Roll 

Direct 

Stick gearing — wing down 

Roll 

Direct 

Stick gearing - wing up 

Roll 

SAS 

Stick gearing 

Roll 

SAS 

Nonlinear stick shaping 

Roll 

SAS 

Roll rate feedback gain 

Yaw 

SAS 

Yaw rate feedback gain 

Yaw 

SAS 

Interconnect function slope 

Yaw 

SAS 

Interconnect function intercept 




TABLE 4. -ERASABLE MEMORY CONSTANTS LOADED 
FOR EACH F-8 DFBW FLIGHT 


Description 

Number 

Control system constants 

168 

Computer downlink identity tags 

100 

Inertial subsystem 

29 

Erasable memory program 
(parabolic stick shaping) 

87 

Miscellaneous 

10 

Total: 394 
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TABLE 5. -DIGITAL SYSTEM DISCREPANCIES DURING GROUND OPERATION 


(a) Discrepancies. 


Item 

Discrepancy 

Reason for discrepancy 

1 

Computer restarts 

Procedural error 

2 

Computer time-of-day wrong 

Procedural error 

3 

Inertial measurement unit test 
result out of specification 

Inertial measurement unit 
degradation for navigation 

a 4 

Yaw direct light cycling on-off 

Failed transistor in mode panel 

a 5 

Backup control system down- 
mode for rudder inputs 

Failure in relay in external fail 
monitor 

6 

Computer locked in loop 

Procedural error 

7 

Failure of preflight test 

Damage to punched tape 

8 

Aileron offset 

Procedural error 

9 

Roll D/A drift during backup 
control system self-test 

Truncation during repeated 
primary/backup control 
system moding 

a io 

Backup control system down- 
mode for aileron inputs 

Failed resistor in external stick 
electronics 


a 


Primary electronics failures . 


(b) Summary. 


Component 

Failures 

Apollo hardware 

0 

Prirfiary electronics 

3 
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TABLE 6. -ELEMENTS OF F-8 DFBW PREFLIGHT TESTS 


Element 

Hangar 

Flight line 

Verify correct memory load 

Yes 

Yes 

Computer self-test 

Yes 

Yes 

Inertial measurement unit fail discretes 

Yes 

No 

Inertial measurement unit turn-on 

Yes 

Yes 

sequence 



Proper aline 

Yes 

Yes 

Pilot gimbal angle indicator 

Yes 

Yes 

Inertial measurement unit operational 

Yes 

No 

test (12 minutes) 



Primary /backup control sy stem 

Yes 

Yes 

moding 



Gain switch discretes 

Yes 

Yes 

Wing position discrete 

Yes 

Yes 

Forced computer restart 

Yes 

Yes 

Inertial measurement unit interface 

Yes 

No 

zero and reset 



Forced computer fail discrete 

Yes 

Yes 

Mode panel warning lights 

Yes 

Yes 

Differential D/A output — backup 

Yes 

No 

control system downmode 

i 


Trim rate and trim fail detection 

Yes 

Yes 

Stick-to-surface gearing measurements 

Yes 

No 

Computer activity 

Yes 

Yes 

Check failure monitor box 

Yes 

Yes 

Maximum surface deflections 

Yes 

Yes 

Load time-of-day 

No 

Yes 

Load computer for flight 

No 

Yes 
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Evaluation by 
additional pilots 



Figure 1. F-8 DFBW flight test summary . 
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Figure 2. F-8 DFBW flight test envelope. 
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Figure 3 . Digital flight control law diagram . 





Yaw SAS: aileron-to-rudder interconnect 
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Figure 3. Continued. 




Integration 
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Figure 3. Concluded 












Figure 4 . Pitch gearing comparison . 
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5-Hz 10-Hz 2-Hz 







(a) Uncompensated system locus . 



(b) Locus with lead-lag compensation . 
Figure 7 . Sampled-data system design . 
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deg/deg/sec 


(b) Improvement in Dutch-roll damping for increase in yaw rate gain 
250 KIAS, 6100 m. 


• Figure 10. Continued. 







Time, sec 


(a) Effect of SAS on damping ratio. Pulse pilot input. 




0 2 4 6 8 10 


Kq = 0.5, no washout filter, 
q $s = 1.5 deg/sec 


Kq = 0.5, with washout filter, 
q $s =2.5 deg/sec 


Time, sec 

(b) Effect of washout filter on steady state response. Step pilot input. 
Figure 12. Pitch SAS operation at low speed. 180 KIAS; wing up. 



-Power approach design envelope 
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Pilot rating 
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Figure 16. Concluded. 




Pilot rating 
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Figure 18. Ground-controlled approach handling qualities summary. Light-to-moderate turbulence. 
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(b) Longitudinal , pitch mode . 










Pilot rating 
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Figure 21. Pilot activity and airplane response in formation flight 







(a) Program change procedure . 


Figure 22 . Software management . 
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Paper tape punched 




Compare with predicted 
memory sums 


10 Flight ready 


(b) Procedure for new erasable memory load 
Figure 22. Concluded. 
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7. A PILOT'S OPINION OF THE F-8 DIGITAL FLY-BY-WIRE AIRPLANE 


Gary E . Krier 

NASA Flight Research Center 


SUMMARY 


The handling qualities of the F-8 digital fly-by- wire airplane are evaluated by 
using the Cooper-Harper rating scale. The reasons for the ratings are given, as 
well as a short description of the flying tasks . It was concluded that the handling 
qualities of the airplane were good in most situations , although occasional ratings of 
unsatisfactory were given . 


INTRODUCTION 


A standard F-8C aircraft was equipped with a roll damper, a yaw damper, and 
an aileron-to-rudder interconnect. The airplane had no pitch damper. Handling 
qualities were satisfactory throughout a large portion of the flight envelope . 

This paper evaluates the airplane's handling qualities on the basis of the 
Cooper-Harper rating scale (ref. 1 and fig. 1) after the removal of the mechanical 
control links and the addition of the Apollo hardware digital fly-by-wire control 
system . 

A force side stick controller was mechanized in the analog backup control system 
and was evaluated by using the same tasks as those used to evaluate the digital 
primary control system . 

The yaw axis was not extensively evaluated , so results are not reported in this 
paper . 

The primary purpose of the program was to expeditiously demonstrate the feasi- 
bility and reliability of a digital fly-by-wire control system for an airplane . The 
space-proved Apollo system was adapted to the airplane, forcing compromises that 
did not allow optimization of the airplane's handling qualities. Nevertheless, the 
handling qualities were mostly satisfactory. 
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SYMBOLS AND ABBREVIATIONS 


BCS 

analog backup control system 

CAS 

command augmentation system 

DIR 

direct mode of control 

q 

dynamic pressure 

SAS 

stability augmentation system 

x-plane 

from wingtip to wingtip of a target aircraft 

y-plane 

from nose to tail of a target aircraft 


CENTER STICK HANDLING QUALITIES 


Takeoff 


Takeoffs with the F-8 digital fly-by-wire airplane were normally made using the 
stability augmentation system (SAS) in all axes. This gave a well damped aircraft 
that handled turbulence effectively. Bank angle control was good and could be set 
quickly and relatively precisely . A pilot rating of 2 on the Cooper-Harper scale 
was given for the takeoff and climbout (figs . 2 and 3) . 


Cruise 

Control for cruising flight was easily adequate and is not further discussed in 
this paper . 


Gross Maneuvering and Aerobatics 

Pitch and roll control for any moderate to high rate maneuver was similar in 
each flight control system configuration. Maneuvers performed with the backup con- 
trol system (BCS) , direct mode (DIR) , SAS , and command augmentation system 
(CAS) appeared very much alike to the pilot, which suggests that these were not 
good tasks for an evaluation . 


Formation Flight 

The ability to fly good wing and trail formation (fig . 4) is a requisite for 
fighter aircraft . It is also a task that rapidly exposes deficiencies in the flight 
control system. Poor control harmony between pitch and roll, poor damping, 
incorrect time constants, undesired force gradients, and other problems are all 
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revealed when the aircraft is put to the formation task. With a good formation-flight 
aircraft , vertical position can be held consistently within 30 centimeters and lateral 
displacement can be held as desired . The task rated with the F-8 digital fly -by - 
wire airplane was the ability to hold a close wing position and to assess the workload 
required to do it . 

While the airplane was in the backup control system , pitch sinusoidal oscillations 
of ±60 centimeters from a base position were caused by the slight delay in response to 
pitch stick inputs . Considerable pilot compensation was required to achieve even 
that amount of control. The response in the stability augmentation system was satis- 
factory but slightly sluggish because we were operating in the flat portion of the 
stick curve (fig, 5) . Control in the direct mode was inferior to control with the 
stability augmentation system because of underdamped short period oscillations . 

By far the most difficulty was encountered in trying to conquer the roll axis . 
Considerable attention was required on the part of the pilot any time formation was 
attempted in the roll backup control system or the direct mode . Response was ob- 
jectionable because of small control deflections when low stick displacements were 
used and fast response when the apparent lag was overcome by using larger stick 
displacements. Using the roll stability augmentation system markedly improved the 
ability to hold close position , possibly because the stability augmentation system 
tended to initially oppose a rapid response to a pilot input . The stability augmenta- 
tion system made the aircraft well behaved up to speeds where quantization became 
a factor . 


Tracking 

Gunsight tracking with a fixed reticle (fig . 6) was flown because it was an ex- 
cellent way to assess the response of the airplane to pilot commands . The film was 
analyzed frame by frame to determine the miss distance , which was referenced to 
the plane running through the target airplane's wingtips (x-plane) or to the plane 
running from the target airplane's nose to its tail (y-plane) . This allowed control 
difficulties to be classified as either a lateral-directional or a pitch problem (figs . 2 
and 3) . 

The pilot's ability to keep the gunsight aiming point (pipper) on the tailpipe of 
the target airplane in a dynamic , tight loop situation was the task rated . 

Tracking in the pitch stability augmentation system was unsatisfactory unless 
considerable trim was used to return the stick to the flatter portion of the parabolic 
deflection curve. If the trimming was omitted, quantization and its accompanying 
short period oscillations caused pipper oscillation in the pitch plane . Tracking in 
the stability augmentation system with a trimmed stick was good enough to perform 
the mission without improvement. The same problems arose in the direct mode, but 
this mode was without pitch rate damping, and was thus rated moderately objection- 
able. 

The pitch backup control system was by far the smoothest of the modes tested 
and afforded good pitch steering at all angles of attack. Some short period 
oscillations occurred, but they were not significant. 
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The difficulties were considerable in the roll axis . There was a definite tendency 
toward pilot-induced oscillations whenever precise, rapid corrections were required. 
This was evident in both the backup control system and the direct mode . The roll 
stability augmentation system reduced the magnitude of the problem, but its sensi- 
tivity degraded the airplane's ability to track precisely. 

The fixed-ratio aileron-to-rudder interconnect produced slight proverse yaw 
during roll-in. This was considered desirable, since it provided a slight lead in 
the direction of the target. 


Ground- Controlled Approach 

Ground-controlled approaches were flown using radar for positioning. This was 
an excellent task for the evaluation of precision control during tight loop instrument 
flight . Deviations from a preset position and altitude were radioed to the pilot , who 
then maneuvered the airplane back toward zero deviation. The response of the air- 
plane to the pilot -initiated corrections was rated . 

Pitch control was fair in the backup control system and the direct mode because 
of the short period oscillations generated by pitch corrections . Pitch response in the 
stability augmentation system was excellent, in that 30-meter-per-minute changes 
could be made in the rate of descent. Corrections in the pitch command augmentation 
system were initiated satisfactorily , but a distracting tendency to overshoot was 
noted that increased the pilot workload and therefore worsened the pilot rating . 

Lateral control with low damping gains showed some deficiencies because of 
continuous low amplitude oscillations up to ±6° of bank. No attempt was made to 
correct this deficiency during the flight test program. 


Landing 


A portion of several flights was devoted to the assessment of the aircraft in 
various control modes in the landing pattern . The pitch backup control system was 
relatively smooth , and there was little tendency for the pilot to couple with the air- 
craft. In the direct mode, however, there was a tendency toward a pilot-induced 
oscillation during wing and gear transients. Sink rate control was fair with both of 
these modes . The stability augmentation system offered good pitch control through- 
out the pattern, with reduced transients and good flare control. The pitch command 
augmentation system was the best mode evaluated , but it masked the speed stability , 
which tended to lead the pilot to believe that changing stick force meant changing 
aerodynamic conditions; that was not always true . 

Flare and touchdown control were satisfactory as long as a slight amount of back 
stick pressure was held to keep the airplane off the flat portion of the parabolic pitch 
curve . If this was not done , the delay in response caused firm landings or balloon- 
ing. 


Lateral control in the landing pattern was characterized by low damping , over- 
responsiveness , and some periods of continuous low amplitude bank excursions. 
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The effects of these characteristics were reduced somewhat by consciously lowering 
the pilot's response and having him accept 1° to 2° deviations from the bank angle 
desired . This was considered moderately obj ectionable in itself , and coupled with 
a strong crosswind it became unacceptable . 

The stability augmentation system reduced the airplane's response to gusts and 
small inputs and therefore it was rated better than the simpler control modes . 


SIDE STICK HANDLING QUALITIES 


The side stick in the F-8 digital fly -by-wire airplane (fig. 7) was installed to 
ascertain whether a force side stick could be used to control an airplane during most 
phases of flight, especially takeoff and landing. No attempt was made to optimize 
the control parameters, although some changes were made for the flights near the 
end of the program . The side stick was mechanized in the analog backup control 
system, which had no dampers. A side stick takeoff was considered the most 
uncertain phase of flight and was therefore performed only after side stick control 
was evaluated in up and away flight . 


Takeoff 

During side stick takeoffs, the pilot applied nosewheel steering (with the center 
stick) until rudder power was sufficient and then moved his right hand to the side 
stick. He made no inputs until lift-off speed was reached, when he applied a smoothly 
increasing pitch force to the stick. No lateral force was used near the ground to 
reduce the tendency for pilot-induced oscillations. Lift-off was smooth and similar 
to center stick takeoffs except that the pilot did not know the elevator and aileron 
positions through stick position (figs. 8 and 9) . 


Gross Maneuvering 

Gross maneuvering was easy with the side stick. Maneuvers such as large 
pitch attitude changes , wind-up turns , wingovers , and aileron rolls were performed 
without difficulty . Crosstalk between pitch and roll was not apparent . 


Formation Flight 


Formation flight, a high pilot gain task, was enlightening during the early de- 
velopment of the F-8 digital fly-by-wire control system , when it exposed the severity 
of the task . Formation flight was also difficult with the side stick . 

Loose wing formation flight could be satisfactorily performed with the side stick , 
although there were occasional random force pulses in pitch or roll. As the distance 
between the two aircraft diminished , the pulsing became more frequent and pro- 
nounced, indicating the tightening of the pilot in the loop. This resulted in a 
tendency for pilot-induced oscillations in pitch or roll or both with the system as it 
was mechanized , that is , without dampers and without attempts at optimization . 
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Some crosstalk (force interaction) was apparent during formation flight . 
Although its effect was not severe , it did start a disturbance in one axis while the 
pilot was trying to control the other axis . 


Tracking 

Side stick tracking was typified by good to excellent control over the lateral^ 
directional axis and continuous oscillations in pitch caused by pitch commands that 
were too abrupt and could not be smoothed. Crosstalk was absent in the tracking 
task. 


Ground- Controlled Approach and Landing 

Power approaches from both pitch out and ground-controlled approach patterns 
were flown easily with the side stick. Roll control was good with respect to bank 
angle itself, but continuous left and right lateral force inputs had to be made. This 
did not degrade bank control , but it did drive the workload up quite a bit . Pitch 
control was precise . 

Many of the approaches were flown in turbulence , which had little adverse 
effect on control . 

Landings were characterized by final approaches that were well controlled down 
to the flare point. The flare was easy to initiate, and control was good almost to 
touchdown. Just before touchdown on every flight , the flightpath was stairstep- 
like . This was caused by pulsing pitch inputs from the pilot . 

No large extraneous motion was generated by a simulated go-around if the trim 
kept the forces down to low levels. 


CONCLUDING REMARKS 


The F-8 digital fly-by-wire airplane was generally well behaved throughout 
the flight envelope tested . Most of the handling qualities deficiencies encountered 
were a result of the original compromises made to adapt the Apollo system to the 
airplane. No extensive attempt to improve the Apollo-related deficiencies was made. 


REFERENCE 


1 . Cooper , George E . ; and Harper , Robert P . , Jr . : The Use of Pilot Rating in the 
Evaluation of Aircraft Handling Qualities. NASA TN D-5153, 1969. 

Flight Research Center 

National Aeronautics and Space Administration 
Edwards, Calif., September 25, 1974 


186 



Excellent 


1 


Controllable 


Acceptable 


Unacceptable 


Satisfactory 


Good 


Unsatisfactory 


Fair 


Some minor but annoying 
deficiencies 


Moderately objectionable 
deficiencies 


Very objectionable deficiencies 


Major deficiencies which require 
mandatory improvement 


Controllable with difficulty 


Marginally controllable in mission 


Uncontrollable 

Control will be lost during some portion of mission 


Uncontrollable in mission 


10 


Figure 1. Cooper-Harper rating scale (ref. 1) . 
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Figure 2 . Center stick pilot ratings in pitch . 
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Figure 3 . Center stick pilot ratings in roll . 
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Figure 4, 


Formation flight . 
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Figure 6 . Gunsight tracking display 
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Figure 9. Side stick pilot ratings in roll. 
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